Dashboards & Visualizations

How to create a multi drop-down dashboard?

New Member

I'm wanting to create a dashboard/form to filter results by 2 or 3 different criteria. I've been looking through some of the walk through's but I am very new to XML (every example I find is all based off of XML) and haven't quite been able to find the right way to do it. This won't be a graph, but filtering event details.

For example: the fields I have in my initial search string are pluginID, pluginName, severity, dnsName, ip, description, pluginText and display both critical and high severity. I'd like to be able to filter between IP address (this wouldn't be static, so i can provide a range, its just whatever is in the results), Severity (this looks like it would be a multiselect input) and possibly family, but having some issues getting that syntax to work.

So just looking for some guidance on where to start other then creating the drop downs and such. Thanks!

0 Karma

SplunkTrust
SplunkTrust

Hi,

I can give you an example from one of my dashboards I've created. This could give you hints to solving your problem.

I have a dashboard that gets populated by the choices you make in the dropdown and radio fields. The radio fields also change depending on the choice you do on the dropdown field.

<form>
  <label>Dashboard_ABC</label>
  <description>this is splunk!</description>
  <row>
    <panel>
      <input type="dropdown" token="field_1">
        <label>somelabel</label>
        <default>Splunk</default>
        <fieldForLabel>Application</fieldForLabel>
        <fieldForValue>field_1</fieldForValue>
        <search>
          <query>index=someindex | dedup field_1 | sort field_1</query>
          <earliest>-60d</earliest>
          <latest>now</latest>
        </search>
      </input>
      <input type="radio" token="field_2" searchWhenChanged="true">
        <label>someotherlabel</label>
        <fieldForLabel>Alert_Category</fieldForLabel>
        <default>*</default>
        <choice value="*">All ________________________________________________________________________________________</choice>
        <fieldForValue>field_2</fieldForValue>
        <search>
          <query>index=someindex field_1="$field_1$" | dedup field_2 | sort field_2</query>
          <earliest>-60d</earliest>
          <latest>now</latest>
        </search>
      </input>
    </panel>
</form>

alt text


Maybe this will help you a bit.

Regards,
pyro_wood

0 Karma

New Member

Thanks for the response. Which is the line for how the results are displayed? I'm assuming I would need to add into where the results are given table pluginID,pluginName,severity,dnsName,ip,description,pluginText ,

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!