Dashboards & Visualizations

How to create a dynamic selection of sources in a dashboard?

Urias
Engager

I have multiple sources with information for an event. I want to make a Dashboard with a total overview of all info available on a given event, but be able to select which sources are displayed. As there are many sources and not all of them always contain event data, I want a dynamic list of check boxes to get a best possible workflow.

I've attempted with a "Multiselect" field dynamically populated with ... | stats values(sourcetype) as types | mvexpand types, but the resulting UI is quite hard to use. I see the ideal solution as a dynamic list of sources with info on the event where the user can select or deselect sources individually.

Is this possible, and how can I achieve this?

0 Karma

niketn
Legend

Here is an example to load Top 5 sourcetypes. Default and static choice value All may not be required. I have just added as example.

<form>
  <label>Example Dashboard with Sourcetype Check Boxes</label>
  <fieldset submitButton="false">
    <input type="time" token="selTime" searchWhenChanged="true">
      <label>Select Time</label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="checkbox" token="chkSourceType" searchWhenChanged="true">
      <label>Source Types</label>
      <choice value="*">All</choice>
      <prefix>sourcetype=</prefix>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_internal earliest=$selTime.earliest$ latest=$selTime.latest$ |top 5 sourcetype | fields sourcetype</query>
      </search>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal status=* $chkSourceType$ | stats count by status</query>
          <earliest>$selTime.earliest$</earliest>
          <latest>$selTime.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
      </chart>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

sssignals
Path Finder

Thanks. Was looking for that part in check box input. Works with minor tweaking.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...