Dashboards & Visualizations

Filter Not get updated with correct Value

shugup2923
Path Finder

I have two filter in Dashboard, In which I am using token of one filter in search of other filter, search is returning the desired result but the previous result of the search is not going away, I need to click dropdown and then select the value.

ACtually I am using the second filter value at different places in dashbaord which is not getting reflected as its not changing in filter.

Anyone who can assist ?

0 Karma

woodcock
Esteemed Legend

You need to use way more words here; your description is way too vague. In general, though, you can usually find an example of these kinds of things in the Dashboards Examples app on Splunkbase; install it and poke around until you find something that you can clone:
https://splunkbase.splunk.com/app/1603/

0 Karma

nareshinsvu
Builder

Can you try this code? Kindly Accept and upvote if it helped. Hope it works for you 🙂

<form>
  <label>Dropdown demo</label>
  <fieldset autoRun="false" submitButton="false">
    <input type="dropdown" token="selected_option" searchWhenChanged="true">
      <label>Select an option</label>
      <default>-</default>
      <choice value="-"></choice>
      <initialValue>-</initialValue>
      <fieldForLabel>Source</fieldForLabel>
      <fieldForValue>Source</fieldForValue>
      <search>
        <query>| makeresults | eval Source="One" | append [ | makeresults | eval Source="Two"] | table Source </query>
        <earliest>0</earliest>
      </search>
       <change>
         <condition match="$selected_option$=&quot;One&quot;">
           <unset token="form.selected_field"></unset>
           <set token="token_field">"APAC- Engine"</set>
           <set token="generic">1</set>
         </condition>
         <condition match="$selected_option$=&quot;Two&quot;">
           <unset token="form.selected_field"></unset>
           <set token="token_field">"EMEA 1 - IDF"</set>
           <set token="generic">1</set>
         </condition> </change></input>
<input type="dropdown" token="selected_field" searchWhenChanged="true" >
   <label>Select field</label>
      <default>-</default>
      <choice value="-"></choice>
      <initialValue>-</initialValue>
    <fieldForLabel>abc</fieldForLabel>
   <fieldForValue>abc</fieldForValue>
   <search>
     <query>|makeresults|eval abc=$token_field$</query>
        <earliest>0</earliest>
      </search>
       <change>
         <condition match="$value$=&quot;APAC- Engine&quot; AND $selected_option$=&quot;One&quot;">
           <set token="selected_T_query">|makeresults |eval Message="My 1st selected option -   $selected_option$ has field  $selected_field$ "| table Message</set>
           <unset token="generic"></unset>
         </condition>
         <condition match="$value$=&quot;EMEA 1 - IDF&quot; AND $selected_option$=&quot;Two&quot;">
           <set token="selected_T_query">|makeresults |eval Message="My 2nd selected option -   $selected_option$ has field  $selected_field$ " | table Message</set>
           <unset token="generic"></unset>
         </condition>
       </change>
    </input>
 </fieldset>
 <row>
    <panel rejects="$generic$">
      <title>$selected_option$  on $selected_field$ </title>
      <table>
        <search>
          <query> $selected_T_query$ </query>
          <earliest>-7d@d</earliest>
          <sampleRatio>1</sampleRatio>
       </search>
    </table>
       </panel>
  </row>
</form>
0 Karma

nareshinsvu
Builder

Kindly Accept and/or upvote if it helped. It might help other splunkers with similar issues.

0 Karma

shugup2923
Path Finder

Dropdown demo

<input type="dropdown" token="selected_option" searchWhenChanged="true">
  <label>Select an option</label>
  <default>-</default>
  <choice value="-"></choice>
  <initialValue>-</initialValue>
  <fieldForLabel>Source</fieldForLabel>
  <fieldForValue>Source</fieldForValue>
  <search>
    <query>| makeresults | eval Source="One" | append [ | makeresults | eval Source="Two"] | table Source </query>
    <earliest>0</earliest>
  </search>
</input>
<input type="dropdown" token="field1">
  <label>field1</label>
  <fieldForLabel>abc</fieldForLabel>
  <fieldForValue>abc</fieldForValue>
  <search>
    <query>| makeresults | eval Source="One" | append [ | makeresults | eval Source="Two"] 

|search Source=$selected_option$
|eval abc=case(Source=="One", "APAC- Engine ", Source=="Two", "EMEA 1 - IDF")
|table abc
-24h@h
now

<panel>
  <title>$field1$</title>
  <table>
    <search>
      <query> $selected_T_query$ </query>
      <earliest>-7d@d</earliest>
      <sampleRatio>1</sampleRatio>
    </search>
  </table>
</panel>
0 Karma

shugup2923
Path Finder

I tried to modified your queries in such way that now you can understand my requirement-
Please consider below points-
1.When you select a option from first filter i.e, One or Two.
2.Value gets changed in field1 filter.
3.But the latest value do not get reflected in below panel where I have give $field1$ token.

When I select One in "select an option" value in field1 should be APAC
and when I select Two value should be EMEA, But its not getting reflected in below panel. It only gets changed when I Manually selects the value from second input i.e field1.

Dropdown demo

<input type="dropdown" token="selected_option" searchWhenChanged="true">
  <label>Select an option</label>
  <default>-</default>
  <choice value="-"></choice>
  <initialValue>-</initialValue>
  <fieldForLabel>Source</fieldForLabel>
  <fieldForValue>Source</fieldForValue>
  <search>
    <query>| makeresults | eval Source="One" | append [ | makeresults | eval Source="Two"] | table Source </query>
    <earliest>0</earliest>
  </search>
</input>
<input type="dropdown" token="field1">
  <label>field1</label>
  <fieldForLabel>abc</fieldForLabel>
  <fieldForValue>abc</fieldForValue>
  <search>
    <query>| makeresults | eval Source="One" | append [ | makeresults | eval Source="Two"] 

|search Source=$selected_option$
|eval abc=case(Source=="One", "APAC- Engine ", Source=="Two", "EMEA 1 - IDF")
|table abc
-24h@h
now

<panel>
  <title>$field1$</title>
  <table>
    <search>
      <query> $selected_T_query$ </query>
      <earliest>-7d@d</earliest>
      <sampleRatio>1</sampleRatio>
    </search>
  </table>
</panel>
0 Karma

nareshinsvu
Builder

How are you dealing with tokens? Are they being referenced as $token$. Below is a small sample reference code with 2 drop-downs if you can relate to yours.
Can you share your code snippet to troubleshoot further?

<form>
  <label>Dropdown demo</label>
  <fieldset autoRun="false" submitButton="false">   
    <input type="dropdown" token="selected_option" searchWhenChanged="true">
      <label>Select an option</label>
      <default>-</default>
      <choice value="-"></choice>
      <initialValue>-</initialValue>
      <fieldForLabel>Source</fieldForLabel>
      <fieldForValue>Source</fieldForValue>
      <search>
        <query>| makeresults | eval Source="One" | append [ | makeresults | eval Source="Two"] | table Source </query>
        <earliest>0</earliest>
      </search>
</input>
    <input type="dropdown" token="selected_date" searchWhenChanged="true">
      <label>Select a Date</label>
      <default></default>
      <choice value="-"></choice>
      <initialValue></initialValue>
      <fieldForLabel>Dates</fieldForLabel>
      <fieldForValue>Dates</fieldForValue>
      <search>
        <query>| gentimes start=-7  |  eval Dates=strftime(starttime,"%Y-%m-%d") |table Dates</query>
         <earliest>-8d@d</earliest>
        <latest>@d</latest>
      </search>
      <change>
        <condition match="$selected_option$=&quot;One&quot;">
          <set token="selected_T_query">index=my_index  |search Day=$selected_date$ Type=$selected_option$</set>
        </condition>
        <condition match="$selected_option$=&quot;Two&quot;">
          <set token="selected_T_query">index=my_other_index  |search Day=$selected_date$ Type=$selected_option$</set>
        </condition>
      </change>
    </input>
 </fieldset>
 <row>
    <panel>
      <title>$selected_option$  on Date - $selected_date$ </title>
      <table>
        <search>
          <query> $selected_T_query$ </query>
          <earliest>-7d@d</earliest>
          <sampleRatio>1</sampleRatio>
       </search>
      </table>
       </panel>
  </row>   
</form>
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...