Dashboards & Visualizations

How to edit my XML for drop-down inputs to properly filter on expected field values?

fmpa_isaac
Path Finder

I have an issue with my drop-down inputs in my dashboard. If I select a dest port 80 from my list, I expect to only see dest port 80 in my results. However, it's also filtering on the source port 80. How can I stop this behavior, because it's occurring in other dashboards that I have?

 </input>
    <input type="multiselect" token="Dest_Port" searchWhenChanged="true">
      <label>Select a Dest Port:</label>
      <search>
        <query>sourcetype="udp:514" host="172.20.1.62" | stats values(Dest_Port) as Dest_Port | mvexpand Dest_Port | sort Dest_Port</query>
      </search>
      <fieldForLabel>Dest_Port</fieldForLabel>
      <fieldForValue>Dest_Port</fieldForValue>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
    <input type="dropdown" token="URL" searchWhenChanged="true">
      <label>Select URL</label>
      <search>
        <query>sourcetype="udp:514" host="172.20.1.62" | stats values(URL) as URL | mvexpand URL | sort URL</query>
      </search>
      <fieldForLabel>URL</fieldForLabel>
      <fieldForValue>URL</fieldForValue>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>sourcetype="udp:514" host="172.20.1.62" $User$ $Action$ $Src_IP$ $Dest_IP$ $Dest_Port$ $URL$ | table _time, User, Src_IP, Src_Port, Dest_IP, Dest_Port, Rule_Action, URL</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">100</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

in your search I don't see anything before $Dest_Port$ and In your dropdown input there isn't the prefix; in this way you don't use the field and the search is limited to the string from the dropdown.
You should use a prefix in the dropdown input as the following

<prefix>Dest_Port="</prefix>
<suffix>"</suffix>

or in the search you shoud insert:
Dest_Port="$Dest_Port$" instead of $Dest_Port$.

Bye.
Giuseppe

View solution in original post

0 Karma

sundareshr
Legend

Try adding fieldnames to each. Like this (adjust for correct field names)

sourcetype="udp:514" host="172.20.1.62" User="$User$" Action="$Action$" Src_IP="$Src_IP$" Dest_IP="$Dest_IP$"  Dest_Post="$Dest_Port$" URL=" $URL$" | table _time, User, Src_IP, Src_Port, Dest_IP, Dest_Port, Rule_Action, URL
0 Karma

fmpa_isaac
Path Finder

Thank you!

0 Karma

gcusello
SplunkTrust
SplunkTrust

in your search I don't see anything before $Dest_Port$ and In your dropdown input there isn't the prefix; in this way you don't use the field and the search is limited to the string from the dropdown.
You should use a prefix in the dropdown input as the following

<prefix>Dest_Port="</prefix>
<suffix>"</suffix>

or in the search you shoud insert:
Dest_Port="$Dest_Port$" instead of $Dest_Port$.

Bye.
Giuseppe

0 Karma

fmpa_isaac
Path Finder

Thank you!

0 Karma

fmpa_isaac
Path Finder

Also, what I am seeing is that it looks for the value of what I am searching for all throughout the raw data.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...