Dashboards & Visualizations

How to customize dashboard to sort location-based details?

itishree
Explorer

I'm trying to get specific details and need some help.

I have two location-based input types, one for the state, and one for the city. I want to see the following details about the city: number of station ID's, station ID, station name, name of the city, name of the state.

Labels (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

Screen Shot 2020-08-04 at 3.22.20 PM.png

 

<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="state">
      <label>state</label>
      <search>
        <query>| makeresults 
| eval state="AndhraPradesh,Karnataka,Tamilnadu" 
| makemv state delim="," 
| mvexpand state 
| table state 
| eval city=case(state="Andhra Pradesh","Nellore,Vijayawada,Vizag",state="Karnataka","Bengaluru,Mysore",state="Tamilnadu","chennai") 
| makemv city delim="," 
| mvexpand city | dedup state | table state</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>state</fieldForLabel>
      <fieldForValue>state</fieldForValue>
    </input>
    <input type="dropdown" token="city">
      <label>city</label>
      <fieldForLabel>city</fieldForLabel>
      <fieldForValue>city</fieldForValue>
      <search>
        <query>| makeresults 
| eval state="AndhraPradesh,Karnataka,Tamilnadu" 
| makemv state delim="," 
| mvexpand state 
| table state 
| eval city=case(state="AndhraPradesh","Nellore,Vijayawada,Vizag",state="Karnataka","Bengaluru,Mysore",state="Tamilnadu","chennai") 
| makemv city delim="," 
| mvexpand city | search state=$state$ | dedup city | table city</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
</form>

----------------------------------------------------------------------

upvote if this is what you are expecting 

————————————
If this helps, give a like below.
0 Karma

itishree
Explorer

Thanks but as per selecting city  i want to get city details 

like id of station ,state name,city name,station name i have 

so i want no. of station id is there and details of that city

0 Karma

johnnykhoueiry
Explorer

You mean after selection the city to create a another panel with the full details ?

0 Karma

thambisetty
SplunkTrust
SplunkTrust

Exactly you have to create panel to shoe city details or anything else you would like to show.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...