Dashboards & Visualizations

How to dynamically fill in a dropdown?

matoulas
Path Finder

Hi all,
We have some custom JSON data getting into Splunk. We're also creating some dashboard with this data. Everything is working great, except for the dynamic drop down.

In our data, (below), we have JSON coming from two different devices, one has a powerdata of branch1 and another has a powerdata of branch1 and branch2.

What I would like to do is to show or display all selections to the maximum reading like (1,2,34,5,6,7,8 and so on) in powerdata for each branch current in the dropdown.

FYI, look similar to the below link, but I would like to rad the data from powerdata for each branch instead of from the plugcount.
https://answers.splunk.com/answers/748424/how-to-dynamically-fill-in-a-dropdown.html#answer-748429

Looking forward to your help.

Here is the JSON sent to Splunk

{   [-] 
     assettag:   VMR-8HS20-2    
     ats:    0  
     branchcount:    1  
     outletmetering:     1  
     plugcount:  8  
     powerdata: [   [-] 
        {   [-] 
         branch1:   [   [-] 
            {   [-] 
             current1:   1.90   
             voltage1:   120.00 
            }   
        ]   
         format:     F  
         temperature:    81 
         timestamp:  2019-06-19T15:16:10+00:00  
        }   
    ]   
     powerdatacount:     1  
     powereff:   100    
     powerfactor:    100    
     powerunit:  1  
     siteid:     LABRACK1   
     timestamp:  2019-06-19T15:16:10+00:00  
}

Here is another JSON sent to Splunk

{   [-] 
     assettag:   CPM-1600-1-ECAM-LAB    
     ats:    1  
     branchcount:    2  
     outletmetering:     1  
     plugcount:  16 
     powerdata: [   [-] 
        {   [-] 
         branch1:   [   [-] 
            {   [-] 
             current1:   0.00   
             current2:   0.20   
             current3:   0.40   
             current4:   0.00   
             current5:   0.00   
             current6:   0.00   
             current7:   0.00   
             current8:   0.00   
             voltage1:   116.00 
            }   
        ]   
         branch2:   [   [-] 
            {   [-] 
             current1:   0.00   
             current2:   0.00   
             current3:   0.00   
             current4:   0.00   
             current5:   0.00   
             current6:   0.00   
             current7:   0.00   
             current8:   0.00   
             voltage1:   114.00 
            }   
        ]   
         timestamp:  2019-06-19T15:33:53+00:00  
        }   
    ]   
     powerdatacount:     1  
     powereff:   100    
     powerfactor:    100    
     powerunit:  1  
     siteid:     LABRACK1   
     timestamp:  2019-06-19T15:33:53+00:00  
}
0 Karma

matoulas
Path Finder

Below is the main search query

index="main" | table sourcetype, siteid, assettag, ats, outletmetering, powerunit, branchcount, plugcount, powerdata{}.branch1{}.current1, powerdata{}.branch1{}.current2, powerdata{}.branch1{}.current3, powerdata{}.branch1{}.current4, powerdata{}.branch1{}.current5, powerdata{}.branch1{}.current6, powerdata{}.branch1{}.current7, powerdata{}.branch1{}.current8, powerdata{}.branch1{}.voltage1, powerdata{}.branch2{}.current1, powerdata{}.branch2{}.current2, powerdata{}.branch2{}.current3, powerdata{}.branch2{}.current4, powerdata{}.branch2{}.current5, powerdata{}.branch2{}.current6, powerdata{}.branch2{}.current7, powerdata{}.branch2{}.current8, powerdata{}.branch2{}.voltage1, timestamp, _time | eval Date/Time=_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Date/Time) | eval timestamp=strptime(timestamp, "%Y-%m-%dT%H:%M:%S")| eval timestamp=strftime(timestamp,"%m-%d-%Y %H:%M:%S") | eval release_year = strftime(timestamp_epoc, "%Y") | fillnull value="No Defined" release_year, ats, outletmetering, powerunit, branchcount, plugcount, powerdata{}.branch1{}.current1, powerdata{}.branch1{}.current2, powerdata{}.branch1{}.current3, powerdata{}.branch1{}.current4, powerdata{}.branch1{}.current5, powerdata{}.branch1{}.current6, powerdata{}.branch1{}.current7, powerdata{}.branch1{}.current8, powerdata{}.branch1{}.voltage1, powerdata{}.branch2{}.current1, powerdata{}.branch2{}.current2, powerdata{}.branch2{}.current3, powerdata{}.branch2{}.current4, powerdata{}.branch2{}.current5, powerdata{}.branch2{}.current6, powerdata{}.branch2{}.current7, powerdata{}.branch2{}.current8, powerdata{}.branch2{}.voltage1 | search sourcetype=powerdata

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...