Dashboards & Visualizations

How to achieve cascading dynamic drop downs with CSV data?

ramana4u
Explorer

Dear Community,

How do I display values from second dropdown values based on first dropdown value.

 

<input type="dropdown" token="site" searchWhenChanged="true">

| inputlookup regions_instances.csv | fields region region_value

 

<input type="dropdown" token="instance" searchWhenChanged="true">

| inputlookup regions_instances.csv | search region=$site$ | fields  instance instance_value

 

 

Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ramana4u,

the approach you followed is correct, what's your issue or doubt?

Ciao.

Giuseppe

0 Karma

ramana4u
Explorer

Image1.PNG

 

Thanks for looking into this.

First dropdown is ok.   No values shown in the second dropdown.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ramana4u,

you should check if the fields in the second lookup is the same of the first and that the value from the first is present in teh second.

Then you don't need to use where, you could use where in the inputlookup command, but thisisn't the issue.

| inputlookup regions_instances.csv WHERE region=$site$ 
| fields instance instance_value

could you share the full code on both inputs?

Are you using Dashboard Classic or Dashboard Studio?

Ciao.

Giuseppe

0 Karma

ramana4u
Explorer

Hi @gcusello 

// Here the full code

<fieldset submitButton="false">
<input type="dropdown" token="dccsite" searchWhenChanged="true">
<label>Choose Site</label>
<fieldForLabel>region</fieldForLabel>
<fieldForValue>region_value</fieldForValue>
<search>
<query>| inputlookup regions_instances.csv | fields region region_value | dedup region  region_value</query>
</search>
<default>express:dcceu:applog</default>
<initialValue>express:dcceu:applog</initialValue>
</input>
<input type="dropdown" token="dccinstance" searchWhenChanged="true">
<label>Choose Instance</label>
<fieldForLabel>instance</fieldForLabel>
<fieldForValue>instance_value</fieldForValue>
<search>
<query>|inputlookup regions_instances.csv | WHERE region=$dccsite$ | fields region region_value instance instance_value</query>
</search>
<default>/appl/dcc/dcceuexp/applogs/*</default>
<initialValue>/appl/dcc/dcceuexp/applogs/*</initialValue>
</input>
</fieldset>

//  regions_instances.csv

region,region_value,instance,instance_value
APEM,express:dcc:applog,Import,/appl/dcc/dccadm/applogs/*
APEM,express:dcc:applog,Export,/appl/dcc/dccexp/applogs/*
EU,express:dcceu:applog,Import,/appl/dcc/dcceu/applogs/*
EU,express:dcceu:applog,Export,/appl/dcc/dcceuexp/applogs/*
Trans,express:dcc:applog*,Import,/appl/dcc/dcceu/dcc2/applogs/*
Trans,express:dcc:applog*,Export,/appl/dcc/dcceuexp/dcc2/applogs/*
US,*express:dcc:applog,Import,/appl/dcc/dccus/applogs/*
US,*express:dcc:applog,Export,/appl/dcc/dccusexp/applogs/*

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ramana4u,

at first try to add quotes to the second input search:

| inputlookup regions_instances.csv | WHERE region="$dccsite$"

then please check if there a mistake between region and region_value maybe you have to use for the filter in the second input again region_value.

If it doesn'ìt run again try to add some asterisk at the beginning and the end of the condition.

| inputlookup regions_instances.csv | WHERE region="*$dccsite$*"

Ciao.

Giuseppe

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...