Dashboards & Visualizations

How to create a dynamic drop-down based on field?

klemenvezjak
Explorer

Hi,
I wan to create one drop-down based on field (this field is host - IP address). So I want to find all hosts on port 4545 (source="tcp:4545") and put them (their IP addresses) in the drop-down menu. Once the user has selected one of the IP addresses from the drop-down menu, I will call this search string: source="tcp:4545" host="selected_ip_address".

My question is how can I create a dynamic drop-down menu based on host field? I need help only for dynamic filling drop-down menu - if it is possible.

Thanks,
Klemen

Tags (1)
1 Solution

ohoppe
SplunkTrust
SplunkTrust

Hi,

here you go.

<form>
  <label>foobar</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="ip">
      <label>IP</label>
      <search>
        <query>|metasearch source="tcp:4545" | dedup host| stats count by host</query>
      </search>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <title>foo</title>
        <search>
          <query>index=_internal source="tcp:4545" host=$ip$</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <fields>["host","source","sourcetype"]</fields>
      </event>
    </panel>
  </row>
</form>

BR
Oliver

View solution in original post

ohoppe
SplunkTrust
SplunkTrust

Hi,

here you go.

<form>
  <label>foobar</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="ip">
      <label>IP</label>
      <search>
        <query>|metasearch source="tcp:4545" | dedup host| stats count by host</query>
      </search>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <title>foo</title>
        <search>
          <query>index=_internal source="tcp:4545" host=$ip$</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <fields>["host","source","sourcetype"]</fields>
      </event>
    </panel>
  </row>
</form>

BR
Oliver

somesoni2
Revered Legend

You can also use this for your dropdown search (may be faster)

| tstats count WHERE index=_internal source="tcp:4545" by host | table host

klemenvezjak
Explorer

Ok, I will try. Thanks

0 Karma

klemenvezjak
Explorer

Great, thank you. It is very easy, but I am just a beginner in Splunk.

Best regards,
Klemen

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...