1 Solution
@ReachDataScientist, you should get Splunk Dashboard Examples app which covers Cascading Form Input example and many more 🙂
You should ideally create a lookup file with mapping of Environments with respective Systems and use lookup as Dynamic Search for dependent dropdown. This will give you flexibility and option to extend your list of systems/environments.
Following example uses run anywhere search as per your question but the same can be changed to lookup once you have it. Please try out and confirm!
<form>
<label>Dependent Drilldown</label>
<fieldset submitButton="false">
<input type="dropdown" token="tokEnvironment" searchWhenChanged="true">
<label>Environment</label>
<choice value="Dev">Dev</choice>
<choice value="Test">Test</choice>
<choice value="Prod">Prod</choice>
<change>
<unset token="tokSystem"></unset>
<unset token="form.tokSystem"></unset>
</change>
</input>
<input type="dropdown" token="tokSystem" searchWhenChanged="true">
<label>System</label>
<fieldForLabel>$tokEnvironment$</fieldForLabel>
<fieldForValue>$tokEnvironment$</fieldForValue>
<search>
<query>| makeresults
| fields - _time
| eval Dev="dev1,dev2,dev3",Test="test1,test2,test3",Prod="prod1,prod2,prod3"
| fields $tokEnvironment$
| makemv $tokEnvironment$ delim=","
| mvexpand $tokEnvironment$</query>
</search>
</input>
</fieldset>
<row>
<panel>
<title>Selected Environment: $tokEnvironment$ | Selected System: $tokSystem$</title>
<html></html>
</panel>
</row>
</form>
@ReachDataScientist, you should get Splunk Dashboard Examples app which covers Cascading Form Input example and many more 🙂
You should ideally create a lookup file with mapping of Environments with respective Systems and use lookup as Dynamic Search for dependent dropdown. This will give you flexibility and option to extend your list of systems/environments.
Following example uses run anywhere search as per your question but the same can be changed to lookup once you have it. Please try out and confirm!
<form>
<label>Dependent Drilldown</label>
<fieldset submitButton="false">
<input type="dropdown" token="tokEnvironment" searchWhenChanged="true">
<label>Environment</label>
<choice value="Dev">Dev</choice>
<choice value="Test">Test</choice>
<choice value="Prod">Prod</choice>
<change>
<unset token="tokSystem"></unset>
<unset token="form.tokSystem"></unset>
</change>
</input>
<input type="dropdown" token="tokSystem" searchWhenChanged="true">
<label>System</label>
<fieldForLabel>$tokEnvironment$</fieldForLabel>
<fieldForValue>$tokEnvironment$</fieldForValue>
<search>
<query>| makeresults
| fields - _time
| eval Dev="dev1,dev2,dev3",Test="test1,test2,test3",Prod="prod1,prod2,prod3"
| fields $tokEnvironment$
| makemv $tokEnvironment$ delim=","
| mvexpand $tokEnvironment$</query>
</search>
</input>
</fieldset>
<row>
<panel>
<title>Selected Environment: $tokEnvironment$ | Selected System: $tokSystem$</title>
<html></html>
</panel>
</row>
</form>
