Dashboards & Visualizations

How edit my dashboard so that when an input is selected, the results of that input is displayed?

pavanae
Builder

I have a Dashboard row as follows

alt text

where search is as follows :-

My search

|stats avg(e) as a_e avg(l) as a_l  values(eval(if(days=1, e, null()))) as y_e values(eval(if(days=1, l, null()))) as y_l by user days 

How can I display the dashboard in such a way that I give the input of a user and then the result dashboard should be only for that user?

0 Karma
1 Solution

sundareshr
Legend

Add a dropdown for user and populate with distinct user list from your data. Like this

<input type="dropdown" token="user">
<search><query>index=foo sourcetype=bar | stats count by user | fields user</query></search>
<fieldForLabel>user</fieldForLabel>
<fieldForValue>user</fieldForValue>
</input>

Then, user the user selection values, that is populated in token user in your second query as a filter criteria, like so

<table>
<search>index=foo user=$user$ | rest of your query here</query></search>
</table>

View solution in original post

0 Karma

sundareshr
Legend

Add a dropdown for user and populate with distinct user list from your data. Like this

<input type="dropdown" token="user">
<search><query>index=foo sourcetype=bar | stats count by user | fields user</query></search>
<fieldForLabel>user</fieldForLabel>
<fieldForValue>user</fieldForValue>
</input>

Then, user the user selection values, that is populated in token user in your second query as a filter criteria, like so

<table>
<search>index=foo user=$user$ | rest of your query here</query></search>
</table>
0 Karma

pavanae
Builder

Where exactly the following values need to be inserted in the html? @sundareshr

table
index=foo user=$user$ | rest of your query here
/table

0 Karma

sundareshr
Legend

This is the search query for showing data in your table, filtered by user value selected. So use this in your table panel.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...