How to apply drop down to all the panels in dashboard?

[purushothama]

Hi,
I am new to Splunk creating my first dashboard.

I have created a drop-down using CSV file as lookup included the column partner_id and partner_name. In my drop down I have included all the partner names but I am not getting how to apply that drop down to all the panels in the dashboard.
Please someone can help me to overcome this?

[vnravikumar · Accepted solution]

Hi

Try like

<form>
  <label>dropdown</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="partner">
      <label>Partner</label>
      <fieldForLabel>partner_id</fieldForLabel>
      <fieldForValue>partner_name</fieldForValue>
      <search>
        <query>|inputlookup partner.csv |table partner_id,  partner_name</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <prefix>partner_id="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index="main" $partner$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Token $partner$ will substitute likepartner_id="p1"

[purushothama]

Hi,

Thank you for your answer,

I have tried what you have to suggested but it s not working. i will share the xml file below please can you help me to change in drop down query. from below source. i am getting all the partner_names in the dropdown list, but i am facing the problem how to apply this drop down to all the panel?

Telemetry by partner_P1

</input>
<input type="dropdown" token="partner_name" searchWhenChanged="true">
  <label>partner</label>
  <fieldForLabel>partner</fieldForLabel>
  <fieldForValue>partner_name</fieldForValue>
  <search>
    <query>index=genesis sourcetype=genesis_body_header_txt AuditEvent_ApplicationId=WebserviceGateway  | lookup Wholesale_Partner_Lookup.csv partner_id as AuditKeys_PARTNERID output partner_name | stats count by partner_name</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </search>
</input>
  <panel>
  <title>Top Errors by Error Code</title>
  <chart>
    <search>
      <query>index=genesis sourcetype=genesis_body_header_txt AuditEvent_Event=GENESIS_TRANSACTION AuditKeys_STATUS=COMPLETE AuditKeys_RESULTS=FAILURE  AuditKeys_ERRORCODE=GENS-0004 OR GENS-0005 OR GENS-0054 OR GENS-0067 OR GENS-0068 OR GENS-0103 OR GENS-0150 OR GENS-0292 OR GENS-0293 OR GENS-0294 OR GENS-0295 OR GENS-0296 OR GENS-0298 OR GENS-0299 OR GENS-0304 OR GENS-0403 AuditKeys_PARTNERID=* | timechart count(AuditKeys_ERRORCODE) as ERRORCODE by AuditKeys_ERRORCODE</query>
      <earliest>$Time Picker.earliest$</earliest>
      <latest>$Time Picker.latest$</latest>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.abbreviation">none</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.abbreviation">none</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.abbreviation">none</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">line</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">zero</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">none</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.mode">standard</option>
    <option name="charting.legend.placement">right</option>
    <option name="charting.lineWidth">2</option>
    <option name="refresh.display">progressbar</option>
    <option name="trellis.enabled">0</option>
    <option name="trellis.scales.shared">1</option>
    <option name="trellis.size">medium</option>
  </chart>

[vnravikumar]

Hi

If I'm not wrong you are trying to filter the result based on partner chosen in the dropdown. If that is the case what is the field name in the index.

[purushothama]

The field name in index is "AuditKeys_PARTNERID" i have declared that as "partner"

[vnravikumar]

Hi

change in prefix with

   <label>Partner</label>
   <fieldForLabel>partner_id</fieldForLabel>
   <fieldForValue>partner_name</fieldForValue>
   <search>
     <query>|inputlookup partner.csv |table partner_id,  partner_name</query>
     <earliest>-24h@h</earliest>
     <latest>now</latest>
   </search>
   <prefix>AuditKeys_PARTNERID="</prefix>
   <suffix>"</suffix>
 </input>

and in query

index=genesis sourcetype=genesis_body_header_txt AuditEvent_Event=GENESIS_TRANSACTION AuditKeys_STATUS=COMPLETE AuditKeys_RESULTS=FAILURE AuditKeys_ERRORCODE=GENS-0004 OR GENS-0005 OR GENS-0054 OR GENS-0067 OR GENS-0068 OR GENS-0103 OR GENS-0150 OR GENS-0292 OR GENS-0293 OR GENS-0294 OR GENS-0295 OR GENS-0296 OR GENS-0298 OR GENS-0299 OR GENS-0304 OR GENS-0403 $partner$ | timechart count(AuditKeys_ERRORCODE) as ERRORCODE by AuditKeys_ERRORCODE

[purushothama]

Hi ravi ,

Thank you for your help,

it is not working as you suggested. i dont know where i am going wrong. Please check the query i have applied in drop down below and let me know if any changes i need to make to get the result. i have used in dropdowm token = partner_name, label=partner, value=partner_name. Please can help me to overcome this issue?

index=genesis sourcetype=genesis_body_header_txt AuditEvent_ApplicationId=WebserviceGateway | lookup Wholesale_Partner_Lookup_Updated.csv partner_id as AuditKeys_PARTNERID output partner_name | stats count by partner_name

[purushothama]

hi ravi,

As your previous suggestion "$partner$" in all the panel query it is working fine. Thank you.

[purushothama]

Based on "AuditKeys_PARTNERID" i have lookup the CSV file to get the partner_name. now i am able to show the partner name in the drop down, but i am not to apply those drop down to all the panel in the dashboard.