Dashboards & Visualizations

How to get all three dynamic drop-downs to interact with my panels and the field application?

JoshuaJohn
Contributor

I have a dynamic drop down that gives me a list of all apps on my device.
ie:
T-Zone 10.1
Runner 9.9
VerMone 10.2
EzConvert 10.1
IntMail 10.1
VPNconnect 9.9

I want to create a static option in that dropdown with all apps that are on version 10.1, and another in that same dropdown for devices on 10.2

I need the search to be dynamic as I do not want to update this dashboard constantly for new apps/versions, but I am unable to enter a query into the static part of my dropdown... so I decided to create three dropdown menus

1) Original Dynamic DropDown
2 static options
-All 10.1 Apps (when selected shows DropDown 2)
-All 10.2 Apps (when selected shows DropDown 3)
Contains all apps

2) Dynamic DropDown (Contains 10.1 Apps)
Contains all apps for 10.1
Plus an All 10.1 apps option

3) 2) Dynamic DropDown (Contains 10.2 Apps)
Contains all apps for 10.2
Plus an All 10.2 apps option

So far when selecting any of these options in the new dropdowns they do not impact my board, my variables names are the same (Application for all of them)

| search "Application"="10.1 Apps"  //With the thought I selected 10.1 in dropdown menu 1
| eval Application=if(Application=="10.1 Apps", "$10_1_Apps$", Application)
| search "Application" "ComplianceState"=*  "Mac_Address"="*"
|chart limit=50 count over Application by ComplianceState
| fields - ComplianceState

Any ideas how I can get DropDown 2 and 3 to interact with my panels and the field Application?

0 Karma
1 Solution

somesoni2
Revered Legend

How about you use something like this for your first dropdown.

Your current search for dropdown 1 which gives all products, say with field name 'Application'
| eval sortorder=1
| appendpipe [| rex field=Application "(?<Version>\d+\.\d+) | stats count by Version | eval Application="*".Version | table Application | eval sortorder=2]
| sort -sortorder Application | table Application

This will fill in your dropdown with values like this

*9.9
*10.1
*10.2
T-Zone 10.1
Runner 9.9
VerMone 10.2
EzConvert 10.1
IntMail 10.1
VPNconnect 9.9

View solution in original post

0 Karma

somesoni2
Revered Legend

How about you use something like this for your first dropdown.

Your current search for dropdown 1 which gives all products, say with field name 'Application'
| eval sortorder=1
| appendpipe [| rex field=Application "(?<Version>\d+\.\d+) | stats count by Version | eval Application="*".Version | table Application | eval sortorder=2]
| sort -sortorder Application | table Application

This will fill in your dropdown with values like this

*9.9
*10.1
*10.2
T-Zone 10.1
Runner 9.9
VerMone 10.2
EzConvert 10.1
IntMail 10.1
VPNconnect 9.9
0 Karma

JoshuaJohn
Contributor

Hmm so close, this gives me the option of *10.1 but when passing the token to the panel it is impacting it only passes *10.2 but I need it to pass "T-Zone" 10.1 OR "EzConvert 10.1" OR "IntMail 10.1"

0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...