Dashboards & Visualizations

How to create a dynamic selection of sources in a dashboard?

Urias
Engager

I have multiple sources with information for an event. I want to make a Dashboard with a total overview of all info available on a given event, but be able to select which sources are displayed. As there are many sources and not all of them always contain event data, I want a dynamic list of check boxes to get a best possible workflow.

I've attempted with a "Multiselect" field dynamically populated with ... | stats values(sourcetype) as types | mvexpand types, but the resulting UI is quite hard to use. I see the ideal solution as a dynamic list of sources with info on the event where the user can select or deselect sources individually.

Is this possible, and how can I achieve this?

0 Karma

niketn
Legend

Here is an example to load Top 5 sourcetypes. Default and static choice value All may not be required. I have just added as example.

<form>
  <label>Example Dashboard with Sourcetype Check Boxes</label>
  <fieldset submitButton="false">
    <input type="time" token="selTime" searchWhenChanged="true">
      <label>Select Time</label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="checkbox" token="chkSourceType" searchWhenChanged="true">
      <label>Source Types</label>
      <choice value="*">All</choice>
      <prefix>sourcetype=</prefix>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_internal earliest=$selTime.earliest$ latest=$selTime.latest$ |top 5 sourcetype | fields sourcetype</query>
      </search>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal status=* $chkSourceType$ | stats count by status</query>
          <earliest>$selTime.earliest$</earliest>
          <latest>$selTime.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
      </chart>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

sssignals
Path Finder

Thanks. Was looking for that part in check box input. Works with minor tweaking.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...