Dashboards & Visualizations

How do you connected static drop-down to table

fabiyogo1
Loves-to-Learn Lots

I have a problem with the splunk classic dashboard that I have created,
where the problem is that the table dashboard that I have created is not connected properly to the dropdown that I have created, as an example I provide the source of the dashboard that I have created as follows:

<input type="text" token="end_id" searchWhenChanged="true">
<label>End To End Id</label>
<default>*</default>
</input>

<input type="dropdown" token="code_cihub">
<label>Code Transaction CI HUB</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>code_cihub</fieldForLabel>
<fieldForValue>code_cihub</fieldForValue>
<search>
<query>index="x"
| where isnotnull(StatusTransactionBI)
| eval "Status Transaction CI HUB" = if(StatusTransactionBI == "U000", "Success", "Failed")
| lookup statust_description.csv code as StatusTransactionBI OUTPUT description
| rename EndtoendIdOrgnlBI as "End To End Id", StatusTransactionBI as "Code Transaction CI HUB", description as "Description CI HUB"
| dedup "End To End Id"
| join type=outer "End To End Id"
[search index="x"
| where isnotnull(StatusTransactionOrgnl)
| eval "Info Transaction CI HUB"=case(AddtionalOrgnl == "O 123", "Normal Transaction",
AddtionalOrgnl == "O 70", "Velocity Transaction",
AddtionalOrgnl == "O 71", "Gambling RFI",
AddtionalOrgnl == "O 72", "Gambling OFI",
AddtionalOrgnl == "O 73", "DTTOT Transaction",
true(), "Other"
)
| rename EndtoendIdOrgnl as "End To End Id"
| search "Info Transaction CI HUB"="$info$"
]
| search "End To End Id"="$end_id$" "Status Transaction CI HUB"="$status_cihub$"
| stats count by "Code Transaction CI HUB"
| rename "Code Transaction CI HUB" as code_cihub</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
</input>

<input type="dropdown" token="info">
<label>Info Transaction CI HUB</label>
<choice value="*">All</choice>
<choice value="O 70">Velocity Transaction</choice>
<choice value="O 71">Gambling RFI</choice>
<choice value="O 72">Gambling OFI</choice>
<choice value="O 73">DTTOT Transaction</choice>
<default>*</default>
<fieldForLabel>info</fieldForLabel>
<fieldForValue>info</fieldForValue>
<search>
<query>index="x"
| where isnotnull(StatusTransactionBI)
| eval "Status Transaction CI HUB" = if(StatusTransactionBI == "U000", "Success", "Failed")
| lookup statust_description.csv code as StatusTransactionBI OUTPUT description
| rename EndtoendIdOrgnlBI as "End To End Id", StatusTransactionBI as "Code Transaction CI HUB", description as "Description CI HUB"
| dedup "End To End Id"
| join type=outer "End To End Id"
[search index="x"
| where isnotnull(StatusTransactionOrgnl)
| eval "Info Transaction CI HUB"=case(AddtionalOrgnl == "O 123", "Normal Transaction",
AddtionalOrgnl == "O 70", "Velocity Transaction",
AddtionalOrgnl == "O 71", "Gambling RFI",
AddtionalOrgnl == "O 72", "Gambling OFI",
AddtionalOrgnl == "O 73", "DTTOT Transaction",
true(), "Other"
)
| rename EndtoendIdOrgnl as "End To End Id"
]
| search "End To End Id"="$end_id$" "Status Transaction CI HUB"="$status_cihub$"
| stats count by "Info Transaction CI HUB"
| rename "Info Transaction CI HUB" as info</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
</input>

<input type="dropdown" token="status_cihub">
<label>Status Transaction CI HUB</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>status_cihub</fieldForLabel>
<fieldForValue>status_cihub</fieldForValue>
<search>
<query>index="x"
| where isnotnull(StatusTransactionBI)
| eval "Status Transaction CI HUB" = if(StatusTransactionBI == "U000", "Success", "Failed")
| lookup statust_description.csv code as StatusTransactionBI OUTPUT description
| rename EndtoendIdOrgnlBI as "End To End Id", StatusTransactionBI as "Code Transaction CI HUB", description as "Description CI HUB"
| dedup "End To End Id"
| join type=outer "End To End Id"
[search index="x"
| where isnotnull(StatusTransactionOrgnl)
| eval "Info Transaction CI HUB"=case(AddtionalOrgnl == "O 123", "Normal Transaction",
AddtionalOrgnl == "O 70", "Velocity Transaction",
AddtionalOrgnl == "O 71", "Gambling RFI",
AddtionalOrgnl == "O 72", "Gambling OFI",
AddtionalOrgnl == "O 73", "DTTOT Transaction",
true(), "Other"
)
| rename EndtoendIdOrgnl as "End To End Id"
| search "Info Transaction CI HUB"="$info$"
]
| search "End To End Id"="$end_id$" "Code Transaction CI HUB"="$code_cihub$"
| stats count by "Status Transaction CI HUB"
| rename "Status Transaction CI HUB" as status_cihub</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
</input>

<row>
<panel>
<table>
<title>Monitoring Response</title>
<search>
<query>index="x"
| where isnotnull(StatusTransactionBI)
| eval "Status Transaction CI HUB" = if(StatusTransactionBI == "U000", "Success", "Failed")
| lookup statust_description.csv code as StatusTransactionBI OUTPUT description
| rename EndtoendIdOrgnlBI as "End To End Id", StatusTransactionBI as "Code Transaction CI HUB", description as "Description CI HUB"
| dedup "End To End Id"
| join type=outer "End To End Id"
[search index="x"
| where isnotnull(StatusTransactionOrgnl)
| eval "Info Transaction CI HUB"=case(AddtionalOrgnl == "O 123", "Normal Transaction",
AddtionalOrgnl == "O 70", "Velocity Transaction",
AddtionalOrgnl == "O 71", "Gambling RFI",
AddtionalOrgnl == "O 72", "Gambling OFI",
AddtionalOrgnl == "O 73", "DTTOT Transaction",
true(), "Other"
)
| rename EndtoendIdOrgnl as "End To End Id"
| search "Info Transaction CI HUB"="$info$"
]
| search "End To End Id"="$end_id$" "Code Transaction CI HUB"="$code_cihub$" "Status Transaction CI HUB"="$status_cihub$"
| table _time, "End To End Id", "Code Transaction CI HUB", "Info Transaction CI HUB", "Status Transaction CI HUB", "Description CI HUB"
| sort - _time</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
</table>
</panel>
</row>

the main problem I'm facing is, on the “Info Transaction CI HUB” dropdown that I made static, where if I select one of the values, the contents in the “Monitoring Response” table do not change according to the dropdown value of “Info Transaction CI HUB” that I have selected before.

please help me to solve the problem
Thank you

Labels (2)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your info token equates to a short code yet your search is converting the code to a friendlier term before you search, could this be why your search is not working?

| eval "Info Transaction CI HUB"=case(AddtionalOrgnl == "O 123", "Normal Transaction",
AddtionalOrgnl == "O 70", "Velocity Transaction",
AddtionalOrgnl == "O 71", "Gambling RFI",
AddtionalOrgnl == "O 72", "Gambling OFI",
AddtionalOrgnl == "O 73", "DTTOT Transaction",
true(), "Other"
)
| rename EndtoendIdOrgnl as "End To End Id"
| search "Info Transaction CI HUB"="$info$"
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...