How to add new values to dropdown in splunk dashboard in default app

[Mukunda7]

Hi ,

I need small help in adding new servers to dropdown list in app dashboard.

 We have some default apps in splunk search head. In one of the app there is a dashboard to monitor login rates of different stadiums for time range in UTC. Those stadiums are under one index X and now they have added two more stadiums under index Y.  Now we need to add those stadiums to that dashboard dropdown to view logins . How can we include these new stadiums to that dashboard. 

I'm admin here this is new task as we don't have splunk developer in the team so can anyone help me from the scratch ?

Thanks in advance..!:)

[ITWhisperer]

Can you share the source SimpleXML of the dropdown in the dashboard you want to change so we can see what it is you are dealing with. You don't need to share the whole dashboard code, just the input section defining the dropdown. Pleas share in a code block like so

    <input type="dropdown" token="stadium">
      <label>...
...
    </input>

[gcusello]

Hi @Mukunda7,

it's difficoult to help you in a blind situation, anyway, probably the search in the dropdown is

| metasearch index=index_x
| dedup host
| sort host
| table host

If this is your situation, you have only to add the second index to the main search

| metasearch index=index_x OR index=index_y
| dedup host
| sort host
| table host

Ciao.

Giuseppe

[Mukunda7]

@gcusello 

Understood but can we add the another index to the query directly in search head or should I need to push in some other way?

[gcusello]

Hi @Mukunda7,

you have to modify the dashboard in this way:

• open the dashboard,
• click Edit,
• click on "Edit Input" of the dropdown,
• modify the search string adding the second index as in my example,
• click on Apply of the dropdown,
• save the Dashboard.

Ciao.

Giuseppe