Dashboards & Visualizations

How can I create a field picker for custom fields in a dashboard

shacharz
Explorer

Just like the time picker in dashboard, I have many panels that are all using a certain field e.g: customerId="..."
And I want to easily filter customers with such a field picker, instead of changing all the search strings in all the panels

0 Karma
1 Solution

Raghav2384
Motivator
Have you considered using a form element?
Example: customerid would be a drop down with all the ids.

Step1: edit xml
Step2: replace <dashboard> & </dashboard> with <form> and </form>
Step3: After label tag insert something like
<fieldset>
<input type="dropdown" token="customerid" searchWhenChanged="false">
<choice value="*"> All</choice>
<default>All</default>
<populatingSearch fieldForValue="customerid" fieldForLabel="customerid">base search...|top 50 customerid</populatingSearch>
</fieldset>
make a token reference in your panel searches 
ex: 
<chart>
<search>
<query>

....base search customerid="$customerid$"|stats count as Purchases 
</query>
</search>
</chart>

search for simple xml forms and that will provide you more examples. Hope this helps
thanks
Raghav

View solution in original post

Raghav2384
Motivator
Have you considered using a form element?
Example: customerid would be a drop down with all the ids.

Step1: edit xml
Step2: replace <dashboard> & </dashboard> with <form> and </form>
Step3: After label tag insert something like
<fieldset>
<input type="dropdown" token="customerid" searchWhenChanged="false">
<choice value="*"> All</choice>
<default>All</default>
<populatingSearch fieldForValue="customerid" fieldForLabel="customerid">base search...|top 50 customerid</populatingSearch>
</fieldset>
make a token reference in your panel searches 
ex: 
<chart>
<search>
<query>

....base search customerid="$customerid$"|stats count as Purchases 
</query>
</search>
</chart>

search for simple xml forms and that will provide you more examples. Hope this helps
thanks
Raghav
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...