How to create a multi drop-down dashboard?

[erazz]

I'm wanting to create a dashboard/form to filter results by 2 or 3 different criteria. I've been looking through some of the walk through's but I am very new to XML (every example I find is all based off of XML) and haven't quite been able to find the right way to do it. This won't be a graph, but filtering event details.

For example: the fields I have in my initial search string are pluginID, pluginName, severity, dnsName, ip, description, pluginText and display both critical and high severity. I'd like to be able to filter between IP address (this wouldn't be static, so i can provide a range, its just whatever is in the results), Severity (this looks like it would be a multiselect input) and possibly family, but having some issues getting that syntax to work.

So just looking for some guidance on where to start other then creating the drop downs and such. Thanks!

[horsefez]

Hi,

I can give you an example from one of my dashboards I've created. This could give you hints to solving your problem.

I have a dashboard that gets populated by the choices you make in the dropdown and radio fields. The radio fields also change depending on the choice you do on the dropdown field.

<form>
  <label>Dashboard_ABC</label>
  <description>this is splunk!</description>
  <row>
    <panel>
      <input type="dropdown" token="field_1">
        <label>somelabel</label>
        <default>Splunk</default>
        <fieldForLabel>Application</fieldForLabel>
        <fieldForValue>field_1</fieldForValue>
        <search>
          <query>index=someindex | dedup field_1 | sort field_1</query>
          <earliest>-60d</earliest>
          <latest>now</latest>
        </search>
      </input>
      <input type="radio" token="field_2" searchWhenChanged="true">
        <label>someotherlabel</label>
        <fieldForLabel>Alert_Category</fieldForLabel>
        <default>*</default>
        <choice value="*">All ________________________________________________________________________________________</choice>
        <fieldForValue>field_2</fieldForValue>
        <search>
          <query>index=someindex field_1="$field_1$" | dedup field_2 | sort field_2</query>
          <earliest>-60d</earliest>
          <latest>now</latest>
        </search>
      </input>
    </panel>
</form>

---

Maybe this will help you a bit.

Regards,
pyro_wood

[erazz]

Thanks for the response. Which is the line for how the results are displayed? I'm assuming I would need to add into where the results are given table pluginID,pluginName,severity,dnsName,ip,description,pluginText ,