Dashboards & Visualizations

How to dynamically fill in a dropdown?

matoulas
Path Finder

Hi all,
We have some custom JSON data getting into Splunk. We're also creating some dashboard with this data. Everything is working great, except for the dynamic drop down.

In our data, (below), we have JSON coming from two different devices, one has a powerdata of branch1 and another has a powerdata of branch1 and branch2.

What I would like to do is to show or display all selections to the maximum reading like (1,2,34,5,6,7,8 and so on) in powerdata for each branch current in the dropdown.

FYI, look similar to the below link, but I would like to rad the data from powerdata for each branch instead of from the plugcount.
https://answers.splunk.com/answers/748424/how-to-dynamically-fill-in-a-dropdown.html#answer-748429

Looking forward to your help.

Here is the JSON sent to Splunk

{   [-] 
     assettag:   VMR-8HS20-2    
     ats:    0  
     branchcount:    1  
     outletmetering:     1  
     plugcount:  8  
     powerdata: [   [-] 
        {   [-] 
         branch1:   [   [-] 
            {   [-] 
             current1:   1.90   
             voltage1:   120.00 
            }   
        ]   
         format:     F  
         temperature:    81 
         timestamp:  2019-06-19T15:16:10+00:00  
        }   
    ]   
     powerdatacount:     1  
     powereff:   100    
     powerfactor:    100    
     powerunit:  1  
     siteid:     LABRACK1   
     timestamp:  2019-06-19T15:16:10+00:00  
}

Here is another JSON sent to Splunk

{   [-] 
     assettag:   CPM-1600-1-ECAM-LAB    
     ats:    1  
     branchcount:    2  
     outletmetering:     1  
     plugcount:  16 
     powerdata: [   [-] 
        {   [-] 
         branch1:   [   [-] 
            {   [-] 
             current1:   0.00   
             current2:   0.20   
             current3:   0.40   
             current4:   0.00   
             current5:   0.00   
             current6:   0.00   
             current7:   0.00   
             current8:   0.00   
             voltage1:   116.00 
            }   
        ]   
         branch2:   [   [-] 
            {   [-] 
             current1:   0.00   
             current2:   0.00   
             current3:   0.00   
             current4:   0.00   
             current5:   0.00   
             current6:   0.00   
             current7:   0.00   
             current8:   0.00   
             voltage1:   114.00 
            }   
        ]   
         timestamp:  2019-06-19T15:33:53+00:00  
        }   
    ]   
     powerdatacount:     1  
     powereff:   100    
     powerfactor:    100    
     powerunit:  1  
     siteid:     LABRACK1   
     timestamp:  2019-06-19T15:33:53+00:00  
}
0 Karma

matoulas
Path Finder

Below is the main search query

index="main" | table sourcetype, siteid, assettag, ats, outletmetering, powerunit, branchcount, plugcount, powerdata{}.branch1{}.current1, powerdata{}.branch1{}.current2, powerdata{}.branch1{}.current3, powerdata{}.branch1{}.current4, powerdata{}.branch1{}.current5, powerdata{}.branch1{}.current6, powerdata{}.branch1{}.current7, powerdata{}.branch1{}.current8, powerdata{}.branch1{}.voltage1, powerdata{}.branch2{}.current1, powerdata{}.branch2{}.current2, powerdata{}.branch2{}.current3, powerdata{}.branch2{}.current4, powerdata{}.branch2{}.current5, powerdata{}.branch2{}.current6, powerdata{}.branch2{}.current7, powerdata{}.branch2{}.current8, powerdata{}.branch2{}.voltage1, timestamp, _time | eval Date/Time=_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Date/Time) | eval timestamp=strptime(timestamp, "%Y-%m-%dT%H:%M:%S")| eval timestamp=strftime(timestamp,"%m-%d-%Y %H:%M:%S") | eval release_year = strftime(timestamp_epoc, "%Y") | fillnull value="No Defined" release_year, ats, outletmetering, powerunit, branchcount, plugcount, powerdata{}.branch1{}.current1, powerdata{}.branch1{}.current2, powerdata{}.branch1{}.current3, powerdata{}.branch1{}.current4, powerdata{}.branch1{}.current5, powerdata{}.branch1{}.current6, powerdata{}.branch1{}.current7, powerdata{}.branch1{}.current8, powerdata{}.branch1{}.voltage1, powerdata{}.branch2{}.current1, powerdata{}.branch2{}.current2, powerdata{}.branch2{}.current3, powerdata{}.branch2{}.current4, powerdata{}.branch2{}.current5, powerdata{}.branch2{}.current6, powerdata{}.branch2{}.current7, powerdata{}.branch2{}.current8, powerdata{}.branch2{}.voltage1 | search sourcetype=powerdata

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...

Upgrade Prep for 10.4, Network Observability Deep Dives, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Splunk Developer Day announcements: AI agents, MCP tools, Forecasting, and Custom ...

Splunk Developer Day was packed with product and platform updates for developers building in the AI ...