Dashboards & Visualizations

How to create a dynamic selection of sources in a dashboard?

Engager

I have multiple sources with information for an event. I want to make a Dashboard with a total overview of all info available on a given event, but be able to select which sources are displayed. As there are many sources and not all of them always contain event data, I want a dynamic list of check boxes to get a best possible workflow.

I've attempted with a "Multiselect" field dynamically populated with ... | stats values(sourcetype) as types | mvexpand types, but the resulting UI is quite hard to use. I see the ideal solution as a dynamic list of sources with info on the event where the user can select or deselect sources individually.

Is this possible, and how can I achieve this?

0 Karma

Legend

Here is an example to load Top 5 sourcetypes. Default and static choice value All may not be required. I have just added as example.

<form>
  <label>Example Dashboard with Sourcetype Check Boxes</label>
  <fieldset submitButton="false">
    <input type="time" token="selTime" searchWhenChanged="true">
      <label>Select Time</label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="checkbox" token="chkSourceType" searchWhenChanged="true">
      <label>Source Types</label>
      <choice value="*">All</choice>
      <prefix>sourcetype=</prefix>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_internal earliest=$selTime.earliest$ latest=$selTime.latest$ |top 5 sourcetype | fields sourcetype</query>
      </search>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal status=* $chkSourceType$ | stats count by status</query>
          <earliest>$selTime.earliest$</earliest>
          <latest>$selTime.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
      </chart>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Path Finder

Thanks. Was looking for that part in check box input. Works with minor tweaking.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!