I would like to add another drilldown/radio button depending on another radio button.
The idea is to make the content change on this second radio button, depending on what has been selected on the first one!
If I select component, I want to be able to select between: Component1, Component2, Component3, ...
same for typeEvent : typeEvent1, typeEvent2, ...
and same for host
Thanks you for your help!
You need to have two radio button inputs as below:
First radio input called "First Selection" populates itself using the "query1". From the query output, the field "myField1" is set as the options of radio input as a table; and whatever value of "myField1" user selects gets saved in the token "myToken1"
Second radio input called "Second Selection" populates itself using the "query2" which uses "myToken1" value. From the query output, the field "myField2" is set as the options of radio input as a table; and whatever value of "myField2" user selects gets saved in the token "myToken2"
Pay attention to
searchWhenChanged="true" and the opening and closing of the
You can add a new Dropdown control which runs Splunk search query to populate Dynamic Options. Following is a near example of your problem:
Step 1: Define a Time input (only way to define earliest and latest timestamps in Downdown control's "Dynamic Options" is through Time control's earliest and latest tokens. Used in Step 3c below.) :
<input type="time" token="selTime" searchWhenChanged="true"> <label>Select Time</label> <default> <earliest>-6h@h</earliest> <latest>now</latest> </default> </input>
Step 2 : Add Radio control with Event Selectors (in this case App Name, Component and Host, with Host being default selection). Since I have picked _internal index for my example field values are app, component and host respectively :
<input type="radio" token="selEvent" searchWhenChanged="true"> <label>Event Selectors</label> <choice value="app">App Name</choice> <choice value="component">Component</choice> <choice value="host">Host</choice> <default>host</default> </input>
Step 3: Define your Event Detail dropown. I have added default as Static Options i.e. Name= All and Value="*". Which should select something like host=* in our case as default search on loading dashboard. For the Dynamic Option I have taken the following steps:
3 a) All fields for radio button must be present in the events being searched. So, add fieldname=* conditions to main search filter query (before first pipe). In our case app=* component=* host=*. Search performance tip is to eliminate unwanted events upfront rather than later. NULL values might show up in this particular example, if field is not present in event being searched.
3 b) Similar to above the final field being plotted in the timechart should also be present in the events. In our case status=*
3 c) Since unique values for selected event types is required only for specified time range, use Time control to define earliest and latest time for Dynamic query. In our case $selTime.earliest$ and $selTime.latest$.
3 d) Store selected event type as a new field using eval (to be used as Dropdown field's dynamic Value and Name later in step 3f ). In our case eval selDetail=$selEvent$
3 e) Use a combination of dedup (to get unique values of selected event type), sort and table to populate Event Type Name for selected event type. Alternatively, lookup table may be used (if possible), instead of dedup as dedup may prove to be slow running command sometimes.
3 f) Apply event detail printed using table command set the fieldForValue and fieldForLabel attributes for Dynamic Options for the Dropdown. In our case selDetail
<input type="dropdown" token="selDetail" searchWhenChanged="true"> <label>Detailed Selector</label> <search> <query>index="_internal" component=* app=* host=* status=* earliest=$selTime.earliest$ latest=$selTime.latest$ | eval selDetail=$selEvent$ | dedup selDetail | sort selDetail | table selDetail</query> </search> <choice value="*">All</choice> <default>*</default> <fieldForLabel>selDetail</fieldForLabel> <fieldForValue>selDetail</fieldForValue> </input>
Step 4: In the dashboard panel search command where timechart is to be displayed, use the Event Type Radio input token and Event Detail Dropdown input dynamic token to add to the main filter search criteria. In our case $selEvent$=$selDetail$. Following is the code:
<search> <query>index="_internal" eventtype=* app=* host=* status=* $selEvent$=$selDetail$ | timechart count by status span=5min limit=20</query> <earliest>$selTime.earliest$</earliest> <latest>$selTime.latest$</latest> </search>
Tokens work inside field selectors. I generally like to limit all my selectors by the time range selected so the options are relevant. You should be able to dynamically populate your selection list using a search with tokens from the other selector.