I have two filter in Dashboard, In which I am using token of one filter in search of other filter, search is returning the desired result but the previous result of the search is not going away, I need to click dropdown and then select the value.
ACtually I am using the second filter value at different places in dashbaord which is not getting reflected as its not changing in filter.
Anyone who can assist ?
You need to use way more words here; your description is way too vague. In general, though, you can usually find an example of these kinds of things in the Dashboards Examples
app on Splunkbase; install it and poke around until you find something that you can clone:
https://splunkbase.splunk.com/app/1603/
Can you try this code? Kindly Accept and upvote if it helped. Hope it works for you 🙂
<form>
<label>Dropdown demo</label>
<fieldset autoRun="false" submitButton="false">
<input type="dropdown" token="selected_option" searchWhenChanged="true">
<label>Select an option</label>
<default>-</default>
<choice value="-"></choice>
<initialValue>-</initialValue>
<fieldForLabel>Source</fieldForLabel>
<fieldForValue>Source</fieldForValue>
<search>
<query>| makeresults | eval Source="One" | append [ | makeresults | eval Source="Two"] | table Source </query>
<earliest>0</earliest>
</search>
<change>
<condition match="$selected_option$="One"">
<unset token="form.selected_field"></unset>
<set token="token_field">"APAC- Engine"</set>
<set token="generic">1</set>
</condition>
<condition match="$selected_option$="Two"">
<unset token="form.selected_field"></unset>
<set token="token_field">"EMEA 1 - IDF"</set>
<set token="generic">1</set>
</condition> </change></input>
<input type="dropdown" token="selected_field" searchWhenChanged="true" >
<label>Select field</label>
<default>-</default>
<choice value="-"></choice>
<initialValue>-</initialValue>
<fieldForLabel>abc</fieldForLabel>
<fieldForValue>abc</fieldForValue>
<search>
<query>|makeresults|eval abc=$token_field$</query>
<earliest>0</earliest>
</search>
<change>
<condition match="$value$="APAC- Engine" AND $selected_option$="One"">
<set token="selected_T_query">|makeresults |eval Message="My 1st selected option - $selected_option$ has field $selected_field$ "| table Message</set>
<unset token="generic"></unset>
</condition>
<condition match="$value$="EMEA 1 - IDF" AND $selected_option$="Two"">
<set token="selected_T_query">|makeresults |eval Message="My 2nd selected option - $selected_option$ has field $selected_field$ " | table Message</set>
<unset token="generic"></unset>
</condition>
</change>
</input>
</fieldset>
<row>
<panel rejects="$generic$">
<title>$selected_option$ on $selected_field$ </title>
<table>
<search>
<query> $selected_T_query$ </query>
<earliest>-7d@d</earliest>
<sampleRatio>1</sampleRatio>
</search>
</table>
</panel>
</row>
</form>
Kindly Accept and/or upvote if it helped. It might help other splunkers with similar issues.
Dropdown demo
<input type="dropdown" token="selected_option" searchWhenChanged="true">
<label>Select an option</label>
<default>-</default>
<choice value="-"></choice>
<initialValue>-</initialValue>
<fieldForLabel>Source</fieldForLabel>
<fieldForValue>Source</fieldForValue>
<search>
<query>| makeresults | eval Source="One" | append [ | makeresults | eval Source="Two"] | table Source </query>
<earliest>0</earliest>
</search>
</input>
<input type="dropdown" token="field1">
<label>field1</label>
<fieldForLabel>abc</fieldForLabel>
<fieldForValue>abc</fieldForValue>
<search>
<query>| makeresults | eval Source="One" | append [ | makeresults | eval Source="Two"]
|search Source=$selected_option$
|eval abc=case(Source=="One", "APAC- Engine ", Source=="Two", "EMEA 1 - IDF")
|table abc
<panel>
<title>$field1$</title>
<table>
<search>
<query> $selected_T_query$ </query>
<earliest>-7d@d</earliest>
<sampleRatio>1</sampleRatio>
</search>
</table>
</panel>
I tried to modified your queries in such way that now you can understand my requirement-
Please consider below points-
1.When you select a option from first filter i.e, One or Two.
2.Value gets changed in field1 filter.
3.But the latest value do not get reflected in below panel where I have give $field1$ token.
When I select One in "select an option" value in field1 should be APAC
and when I select Two value should be EMEA, But its not getting reflected in below panel. It only gets changed when I Manually selects the value from second input i.e field1.
Dropdown demo
<input type="dropdown" token="selected_option" searchWhenChanged="true">
<label>Select an option</label>
<default>-</default>
<choice value="-"></choice>
<initialValue>-</initialValue>
<fieldForLabel>Source</fieldForLabel>
<fieldForValue>Source</fieldForValue>
<search>
<query>| makeresults | eval Source="One" | append [ | makeresults | eval Source="Two"] | table Source </query>
<earliest>0</earliest>
</search>
</input>
<input type="dropdown" token="field1">
<label>field1</label>
<fieldForLabel>abc</fieldForLabel>
<fieldForValue>abc</fieldForValue>
<search>
<query>| makeresults | eval Source="One" | append [ | makeresults | eval Source="Two"]
|search Source=$selected_option$
|eval abc=case(Source=="One", "APAC- Engine ", Source=="Two", "EMEA 1 - IDF")
|table abc
<panel>
<title>$field1$</title>
<table>
<search>
<query> $selected_T_query$ </query>
<earliest>-7d@d</earliest>
<sampleRatio>1</sampleRatio>
</search>
</table>
</panel>
How are you dealing with tokens? Are they being referenced as $token$
. Below is a small sample reference code with 2 drop-downs if you can relate to yours.
Can you share your code snippet to troubleshoot further?
<form>
<label>Dropdown demo</label>
<fieldset autoRun="false" submitButton="false">
<input type="dropdown" token="selected_option" searchWhenChanged="true">
<label>Select an option</label>
<default>-</default>
<choice value="-"></choice>
<initialValue>-</initialValue>
<fieldForLabel>Source</fieldForLabel>
<fieldForValue>Source</fieldForValue>
<search>
<query>| makeresults | eval Source="One" | append [ | makeresults | eval Source="Two"] | table Source </query>
<earliest>0</earliest>
</search>
</input>
<input type="dropdown" token="selected_date" searchWhenChanged="true">
<label>Select a Date</label>
<default></default>
<choice value="-"></choice>
<initialValue></initialValue>
<fieldForLabel>Dates</fieldForLabel>
<fieldForValue>Dates</fieldForValue>
<search>
<query>| gentimes start=-7 | eval Dates=strftime(starttime,"%Y-%m-%d") |table Dates</query>
<earliest>-8d@d</earliest>
<latest>@d</latest>
</search>
<change>
<condition match="$selected_option$="One"">
<set token="selected_T_query">index=my_index |search Day=$selected_date$ Type=$selected_option$</set>
</condition>
<condition match="$selected_option$="Two"">
<set token="selected_T_query">index=my_other_index |search Day=$selected_date$ Type=$selected_option$</set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<title>$selected_option$ on Date - $selected_date$ </title>
<table>
<search>
<query> $selected_T_query$ </query>
<earliest>-7d@d</earliest>
<sampleRatio>1</sampleRatio>
</search>
</table>
</panel>
</row>
</form>