Dashboards & Visualizations

How do you connected static drop-down to table

fabiyogo1
Loves-to-Learn Lots

I have a problem with the splunk classic dashboard that I have created,
where the problem is that the table dashboard that I have created is not connected properly to the dropdown that I have created, as an example I provide the source of the dashboard that I have created as follows:

<input type="text" token="end_id" searchWhenChanged="true">
<label>End To End Id</label>
<default>*</default>
</input>

<input type="dropdown" token="code_cihub">
<label>Code Transaction CI HUB</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>code_cihub</fieldForLabel>
<fieldForValue>code_cihub</fieldForValue>
<search>
<query>index="x"
| where isnotnull(StatusTransactionBI)
| eval "Status Transaction CI HUB" = if(StatusTransactionBI == "U000", "Success", "Failed")
| lookup statust_description.csv code as StatusTransactionBI OUTPUT description
| rename EndtoendIdOrgnlBI as "End To End Id", StatusTransactionBI as "Code Transaction CI HUB", description as "Description CI HUB"
| dedup "End To End Id"
| join type=outer "End To End Id"
[search index="x"
| where isnotnull(StatusTransactionOrgnl)
| eval "Info Transaction CI HUB"=case(AddtionalOrgnl == "O 123", "Normal Transaction",
AddtionalOrgnl == "O 70", "Velocity Transaction",
AddtionalOrgnl == "O 71", "Gambling RFI",
AddtionalOrgnl == "O 72", "Gambling OFI",
AddtionalOrgnl == "O 73", "DTTOT Transaction",
true(), "Other"
)
| rename EndtoendIdOrgnl as "End To End Id"
| search "Info Transaction CI HUB"="$info$"
]
| search "End To End Id"="$end_id$" "Status Transaction CI HUB"="$status_cihub$"
| stats count by "Code Transaction CI HUB"
| rename "Code Transaction CI HUB" as code_cihub</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
</input>

<input type="dropdown" token="info">
<label>Info Transaction CI HUB</label>
<choice value="*">All</choice>
<choice value="O 70">Velocity Transaction</choice>
<choice value="O 71">Gambling RFI</choice>
<choice value="O 72">Gambling OFI</choice>
<choice value="O 73">DTTOT Transaction</choice>
<default>*</default>
<fieldForLabel>info</fieldForLabel>
<fieldForValue>info</fieldForValue>
<search>
<query>index="x"
| where isnotnull(StatusTransactionBI)
| eval "Status Transaction CI HUB" = if(StatusTransactionBI == "U000", "Success", "Failed")
| lookup statust_description.csv code as StatusTransactionBI OUTPUT description
| rename EndtoendIdOrgnlBI as "End To End Id", StatusTransactionBI as "Code Transaction CI HUB", description as "Description CI HUB"
| dedup "End To End Id"
| join type=outer "End To End Id"
[search index="x"
| where isnotnull(StatusTransactionOrgnl)
| eval "Info Transaction CI HUB"=case(AddtionalOrgnl == "O 123", "Normal Transaction",
AddtionalOrgnl == "O 70", "Velocity Transaction",
AddtionalOrgnl == "O 71", "Gambling RFI",
AddtionalOrgnl == "O 72", "Gambling OFI",
AddtionalOrgnl == "O 73", "DTTOT Transaction",
true(), "Other"
)
| rename EndtoendIdOrgnl as "End To End Id"
]
| search "End To End Id"="$end_id$" "Status Transaction CI HUB"="$status_cihub$"
| stats count by "Info Transaction CI HUB"
| rename "Info Transaction CI HUB" as info</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
</input>

<input type="dropdown" token="status_cihub">
<label>Status Transaction CI HUB</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>status_cihub</fieldForLabel>
<fieldForValue>status_cihub</fieldForValue>
<search>
<query>index="x"
| where isnotnull(StatusTransactionBI)
| eval "Status Transaction CI HUB" = if(StatusTransactionBI == "U000", "Success", "Failed")
| lookup statust_description.csv code as StatusTransactionBI OUTPUT description
| rename EndtoendIdOrgnlBI as "End To End Id", StatusTransactionBI as "Code Transaction CI HUB", description as "Description CI HUB"
| dedup "End To End Id"
| join type=outer "End To End Id"
[search index="x"
| where isnotnull(StatusTransactionOrgnl)
| eval "Info Transaction CI HUB"=case(AddtionalOrgnl == "O 123", "Normal Transaction",
AddtionalOrgnl == "O 70", "Velocity Transaction",
AddtionalOrgnl == "O 71", "Gambling RFI",
AddtionalOrgnl == "O 72", "Gambling OFI",
AddtionalOrgnl == "O 73", "DTTOT Transaction",
true(), "Other"
)
| rename EndtoendIdOrgnl as "End To End Id"
| search "Info Transaction CI HUB"="$info$"
]
| search "End To End Id"="$end_id$" "Code Transaction CI HUB"="$code_cihub$"
| stats count by "Status Transaction CI HUB"
| rename "Status Transaction CI HUB" as status_cihub</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
</input>

<row>
<panel>
<table>
<title>Monitoring Response</title>
<search>
<query>index="x"
| where isnotnull(StatusTransactionBI)
| eval "Status Transaction CI HUB" = if(StatusTransactionBI == "U000", "Success", "Failed")
| lookup statust_description.csv code as StatusTransactionBI OUTPUT description
| rename EndtoendIdOrgnlBI as "End To End Id", StatusTransactionBI as "Code Transaction CI HUB", description as "Description CI HUB"
| dedup "End To End Id"
| join type=outer "End To End Id"
[search index="x"
| where isnotnull(StatusTransactionOrgnl)
| eval "Info Transaction CI HUB"=case(AddtionalOrgnl == "O 123", "Normal Transaction",
AddtionalOrgnl == "O 70", "Velocity Transaction",
AddtionalOrgnl == "O 71", "Gambling RFI",
AddtionalOrgnl == "O 72", "Gambling OFI",
AddtionalOrgnl == "O 73", "DTTOT Transaction",
true(), "Other"
)
| rename EndtoendIdOrgnl as "End To End Id"
| search "Info Transaction CI HUB"="$info$"
]
| search "End To End Id"="$end_id$" "Code Transaction CI HUB"="$code_cihub$" "Status Transaction CI HUB"="$status_cihub$"
| table _time, "End To End Id", "Code Transaction CI HUB", "Info Transaction CI HUB", "Status Transaction CI HUB", "Description CI HUB"
| sort - _time</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
</table>
</panel>
</row>

the main problem I'm facing is, on the “Info Transaction CI HUB” dropdown that I made static, where if I select one of the values, the contents in the “Monitoring Response” table do not change according to the dropdown value of “Info Transaction CI HUB” that I have selected before.

please help me to solve the problem
Thank you

Labels (2)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your info token equates to a short code yet your search is converting the code to a friendlier term before you search, could this be why your search is not working?

| eval "Info Transaction CI HUB"=case(AddtionalOrgnl == "O 123", "Normal Transaction",
AddtionalOrgnl == "O 70", "Velocity Transaction",
AddtionalOrgnl == "O 71", "Gambling RFI",
AddtionalOrgnl == "O 72", "Gambling OFI",
AddtionalOrgnl == "O 73", "DTTOT Transaction",
true(), "Other"
)
| rename EndtoendIdOrgnl as "End To End Id"
| search "Info Transaction CI HUB"="$info$"
0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...