Dashboards & Visualizations

How to get all three dynamic drop-downs to interact with my panels and the field application?

JoshuaJohn
Contributor

I have a dynamic drop down that gives me a list of all apps on my device.
ie:
T-Zone 10.1
Runner 9.9
VerMone 10.2
EzConvert 10.1
IntMail 10.1
VPNconnect 9.9

I want to create a static option in that dropdown with all apps that are on version 10.1, and another in that same dropdown for devices on 10.2

I need the search to be dynamic as I do not want to update this dashboard constantly for new apps/versions, but I am unable to enter a query into the static part of my dropdown... so I decided to create three dropdown menus

1) Original Dynamic DropDown
2 static options
-All 10.1 Apps (when selected shows DropDown 2)
-All 10.2 Apps (when selected shows DropDown 3)
Contains all apps

2) Dynamic DropDown (Contains 10.1 Apps)
Contains all apps for 10.1
Plus an All 10.1 apps option

3) 2) Dynamic DropDown (Contains 10.2 Apps)
Contains all apps for 10.2
Plus an All 10.2 apps option

So far when selecting any of these options in the new dropdowns they do not impact my board, my variables names are the same (Application for all of them)

| search "Application"="10.1 Apps"  //With the thought I selected 10.1 in dropdown menu 1
| eval Application=if(Application=="10.1 Apps", "$10_1_Apps$", Application)
| search "Application" "ComplianceState"=*  "Mac_Address"="*"
|chart limit=50 count over Application by ComplianceState
| fields - ComplianceState

Any ideas how I can get DropDown 2 and 3 to interact with my panels and the field Application?

0 Karma
1 Solution

somesoni2
Revered Legend

How about you use something like this for your first dropdown.

Your current search for dropdown 1 which gives all products, say with field name 'Application'
| eval sortorder=1
| appendpipe [| rex field=Application "(?<Version>\d+\.\d+) | stats count by Version | eval Application="*".Version | table Application | eval sortorder=2]
| sort -sortorder Application | table Application

This will fill in your dropdown with values like this

*9.9
*10.1
*10.2
T-Zone 10.1
Runner 9.9
VerMone 10.2
EzConvert 10.1
IntMail 10.1
VPNconnect 9.9

View solution in original post

0 Karma

somesoni2
Revered Legend

How about you use something like this for your first dropdown.

Your current search for dropdown 1 which gives all products, say with field name 'Application'
| eval sortorder=1
| appendpipe [| rex field=Application "(?<Version>\d+\.\d+) | stats count by Version | eval Application="*".Version | table Application | eval sortorder=2]
| sort -sortorder Application | table Application

This will fill in your dropdown with values like this

*9.9
*10.1
*10.2
T-Zone 10.1
Runner 9.9
VerMone 10.2
EzConvert 10.1
IntMail 10.1
VPNconnect 9.9
0 Karma

JoshuaJohn
Contributor

Hmm so close, this gives me the option of *10.1 but when passing the token to the panel it is impacting it only passes *10.2 but I need it to pass "T-Zone" 10.1 OR "EzConvert 10.1" OR "IntMail 10.1"

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...