How can Dashboard inputs drive pivot table panels?

[guchster]

I have a few panels that are driven by pivot tables. Is there a way to use the dashboard inputs as a filter in the search string for these panels?

[marcoscala]

Sure you can't! Use the "|pivot " command to drive your pivot table and add the custom condition driven by the input fields in your search.

[muzixulu]

Hi

Sorry to take you backwards.

But how exactly do you do it? I'm new to Splunk

Regards

[helge]

I take it you mean "you can" insteaf of "you can't"?!

[marcoscala]

Yep...... too quick to answer from my iPad....
here's a sample using the OIDemo DataModel

    <title>Pivot - Sales</title>
    <search>
      <query>| pivot OIDemo Sales count(Sales) AS "Numero di Sales" SPLITROW _time AS _time PERIOD auto FILTER planType is * FILTER networkProviderName is $networkProvider$ SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1</query>
      <earliest>-30d@d</earliest>
      <latest>now</latest>
    </search>

...

But you can also use directly the "tstats" command, which is more powerful and flexible in setting conditions and let you manipulate freely the results:

      <query>|tstats avg(Orders.Sales.planPrice) AS ARPU FROM datamodel=OIDemo WHERE (nodename=Orders.Sales)  $networkProvider$ $planType$ | eval avg=59 | eval ARPU=round(ARPU,2) | transpose | rename "row 1" as ARPU | fields ARPU | rangemap field=ARPU low=60-999 elevated=53-59 high=43-52 severe=0-42 default=low</query>
      <earliest>-30d@d</earliest>
      <latest>now</latest>
    </search>