Hello,
I am seeing help with making my dashboard auto filter results. For example, in one of my panels I have a field that has various car names in it.
ie:
Camero
Cadillac
Camero SS
Cadillac SS
When I type into my Text Box for example, 'Cam' I want this to automatically filter the results without submitting the search so I only see Camero, Camero SS.
This can either be done with a search or I can throw this into a lookup table and search that from the dashboard.
Basically, you're looking for postprocessing. It's not REALLY without a search, but it wouldn't have to go back to the underlying base search.
Here's the reference
http://docs.splunk.com/Documentation/Splunk/6.2.3/Viz/Savedsearches#Post-process_searches
Here's some examples -
https://answers.splunk.com/answers/218649/example-simple-xml-using-postprocess.html
https://answers.splunk.com/answers/246437/how-do-i-optimize-the-performance-of-my-dashboard.html
DalJeanis,
Thank you for the response but I am looking for something more along the lines of dynamically filtering results as stated if I type in "Cam," it will filter for results with "Cam" in it without having to kick off another search.
Or am I wrong and with using "Cam" for example, this will somehow search without hitting enter and using that as a token in the postprocess search (after base search)?
I don't know of any tooltip-like instant filtering setup with splunk. At the very least, the postprocessing search would have to be "refreshing" (ie re-searching) after every keystroke.
Even toggling some data to hidden would require some part of the computer to be re-comparing data, which amounts to the same thing. It's not impossible, so maybe someone has developed it.