Dashboards & Visualizations

How to create a dynamic selection of sources in a dashboard?

Urias
Engager

I have multiple sources with information for an event. I want to make a Dashboard with a total overview of all info available on a given event, but be able to select which sources are displayed. As there are many sources and not all of them always contain event data, I want a dynamic list of check boxes to get a best possible workflow.

I've attempted with a "Multiselect" field dynamically populated with ... | stats values(sourcetype) as types | mvexpand types, but the resulting UI is quite hard to use. I see the ideal solution as a dynamic list of sources with info on the event where the user can select or deselect sources individually.

Is this possible, and how can I achieve this?

0 Karma

niketn
Legend

Here is an example to load Top 5 sourcetypes. Default and static choice value All may not be required. I have just added as example.

<form>
  <label>Example Dashboard with Sourcetype Check Boxes</label>
  <fieldset submitButton="false">
    <input type="time" token="selTime" searchWhenChanged="true">
      <label>Select Time</label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="checkbox" token="chkSourceType" searchWhenChanged="true">
      <label>Source Types</label>
      <choice value="*">All</choice>
      <prefix>sourcetype=</prefix>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_internal earliest=$selTime.earliest$ latest=$selTime.latest$ |top 5 sourcetype | fields sourcetype</query>
      </search>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal status=* $chkSourceType$ | stats count by status</query>
          <earliest>$selTime.earliest$</earliest>
          <latest>$selTime.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
      </chart>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

sssignals
Path Finder

Thanks. Was looking for that part in check box input. Works with minor tweaking.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...