Dashboards & Visualizations

How to dynamically change the dropdown menu of a dashboard as a result of selecting another dropdown?

tmontney
Builder

I have a processes dashboard, with two dropdown menus: Computer and Process Name. Not all computers have the same processes running, so I don't want to pull all possible processes (from all computers). If I select my computer, the process dropdown menu should repopulate. Unfortunately, I don't see that happening.

0 Karma
1 Solution

gokadroid
Motivator

If you want two dropdowns that should populate dynamically, then using the query within the dropdowns is an option. You have to have querywhich will populate the field , say,computerNamein first dropdown and then assign it tocomputer_nametoken. The second dropdown query then can use thiscomputer_tokento search and list all the fieldprocessName` and show it in second dropdown. Try something like below:

 <input type="dropdown" searchWhenChanged="true" token="computer_token">
      <label>Computers Dropdown</label>
      <choice value="*">All Computers</choice>
      <search>
        <query>index=yourIndex sourcetype=yourSourceType | stats count by computerName</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>computerName</fieldForLabel>
      <fieldForValue>computerName</fieldForValue>
    </input>
    <input type="dropdown" searchWhenChanged="true" token="process_token">
      <label>BackEnd</label>
      <choice value="*">All</choice>
      <search>
        <query>index=yourIndex sourcetype=yourSourceType computerName=$computer_token$ | stats count by ProcessName</query>
        <earliest>-24h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>ProcessName</fieldForLabel>
      <fieldForValue>ProcessName</fieldForValue>
    </input>

From here on, both $computer_token$ and $process_token$ can be used in a panel query to filter for any specific computerNmae and processName combination.

View solution in original post

gokadroid
Motivator

If you want two dropdowns that should populate dynamically, then using the query within the dropdowns is an option. You have to have querywhich will populate the field , say,computerNamein first dropdown and then assign it tocomputer_nametoken. The second dropdown query then can use thiscomputer_tokento search and list all the fieldprocessName` and show it in second dropdown. Try something like below:

 <input type="dropdown" searchWhenChanged="true" token="computer_token">
      <label>Computers Dropdown</label>
      <choice value="*">All Computers</choice>
      <search>
        <query>index=yourIndex sourcetype=yourSourceType | stats count by computerName</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>computerName</fieldForLabel>
      <fieldForValue>computerName</fieldForValue>
    </input>
    <input type="dropdown" searchWhenChanged="true" token="process_token">
      <label>BackEnd</label>
      <choice value="*">All</choice>
      <search>
        <query>index=yourIndex sourcetype=yourSourceType computerName=$computer_token$ | stats count by ProcessName</query>
        <earliest>-24h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>ProcessName</fieldForLabel>
      <fieldForValue>ProcessName</fieldForValue>
    </input>

From here on, both $computer_token$ and $process_token$ can be used in a panel query to filter for any specific computerNmae and processName combination.

tmontney
Builder

You're simply saying to reference the computer token in my process query, right?

0 Karma

gokadroid
Motivator

Yes, reference your computer token in process query and that should list the process corresponding to the computer which got selected.

0 Karma

tmontney
Builder

Weird. I had done just that before asking and I didn't see "populating". I came back to it after working on some other dashboards, and it seems to be working.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...