Dashboards & Visualizations

How do you create a dropdown with 3 different source types to display a graph per source type?

splunkuseradmin
Path Finder

hi all,

I am trying to create a dropdown with 3 different source types to display a graph per source type.
If I try to change the source type, the graph doesn't show up.

0 Karma
1 Solution

renjith_nair
Legend

@splunkuseradmin,

In the rename and eval you are not using the tokens but string values. Also your drop down values are wildcards and can't be renamed to a single value. i.e. rename *something as otherthing wont work
If you have only two fields in the final result i.e. jp_200_* and jp_404_*, try this

Changes are highlighted by comments

<form>
  <label>Drilldown</label>
  <fieldset submitButton="false">
   <input type="time" token="field1" searchWhenChanged="true">
   <label>Select Time</label>
   <default>
     <earliest>0</earliest>
     <latest></latest>
   </default>
 </input>
 <input type="dropdown" token="host" searchWhenChanged="true">
   <label>Select Host</label>
   <search>
     <query/>
     <earliest>-24h@h</earliest>
     <latest>now</latest>
   </search>
   <!------ COMMENT : Changed sourcetype from wild cards to single value ---------->
   <choice value="&quot;usac2-photos01.example.com-too_small&quot;">"usac2-photos01.example.com-too_small"</choice>
   <choice value="&quot;usac2-photos02.example.com-too_small&quot;">"usac2-photos02.example.com-too_small"</choice>
   <choice value="&quot;usac2-photos03.example.com-too_small&quot;">"usac2-photos03.example.com-too_small"</choice>
 </input>
  </fieldset>
  <row>
 <panel>
   <title>Photos Count of Url Hits</title>
   <chart>
     <search>
        <!---------- COMMENT : Changed sourcetype=*$host$ from $host$ ---------->
          <query>index=test_jp sourcetype="*$host$" | rex "(?i)^(?P<jp_hits>.+)" 
         | timechart span=1h eval(avg(jp_hits)) by sourcetype useother=f limit=0 
         <!-----------COMMENT : Substituted tokens in the rename ---------->
         | rename jp_200_$host$ as jp_200_hits, jp_404_$host$ as jp_404_hits
         | eval "totalhits" = jp_200_hits+jp_404_hits
         | table _time jp_200_hits jp_404_hits totalhits</query>
                   <earliest>$field1.earliest$</earliest>
                   <latest>$field1.latest$</latest>
                   <sampleRatio>1</sampleRatio>
         </search>
       </chart>
     </panel>
</row>     
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@splunkuseradmin,

In the rename and eval you are not using the tokens but string values. Also your drop down values are wildcards and can't be renamed to a single value. i.e. rename *something as otherthing wont work
If you have only two fields in the final result i.e. jp_200_* and jp_404_*, try this

Changes are highlighted by comments

<form>
  <label>Drilldown</label>
  <fieldset submitButton="false">
   <input type="time" token="field1" searchWhenChanged="true">
   <label>Select Time</label>
   <default>
     <earliest>0</earliest>
     <latest></latest>
   </default>
 </input>
 <input type="dropdown" token="host" searchWhenChanged="true">
   <label>Select Host</label>
   <search>
     <query/>
     <earliest>-24h@h</earliest>
     <latest>now</latest>
   </search>
   <!------ COMMENT : Changed sourcetype from wild cards to single value ---------->
   <choice value="&quot;usac2-photos01.example.com-too_small&quot;">"usac2-photos01.example.com-too_small"</choice>
   <choice value="&quot;usac2-photos02.example.com-too_small&quot;">"usac2-photos02.example.com-too_small"</choice>
   <choice value="&quot;usac2-photos03.example.com-too_small&quot;">"usac2-photos03.example.com-too_small"</choice>
 </input>
  </fieldset>
  <row>
 <panel>
   <title>Photos Count of Url Hits</title>
   <chart>
     <search>
        <!---------- COMMENT : Changed sourcetype=*$host$ from $host$ ---------->
          <query>index=test_jp sourcetype="*$host$" | rex "(?i)^(?P<jp_hits>.+)" 
         | timechart span=1h eval(avg(jp_hits)) by sourcetype useother=f limit=0 
         <!-----------COMMENT : Substituted tokens in the rename ---------->
         | rename jp_200_$host$ as jp_200_hits, jp_404_$host$ as jp_404_hits
         | eval "totalhits" = jp_200_hits+jp_404_hits
         | table _time jp_200_hits jp_404_hits totalhits</query>
                   <earliest>$field1.earliest$</earliest>
                   <latest>$field1.latest$</latest>
                   <sampleRatio>1</sampleRatio>
         </search>
       </chart>
     </panel>
</row>     
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...