Dashboards & Visualizations

How to have the best dropdown + OR statement?

kwanx
Explorer

Hello - assistance please.

Looking for best way to have an OR statement for "choice value" in drop down config.

Similar to this, but this does not work:

<input type="dropdown" token="location">
        <label>location</label>
        <choice value="*">ALL</choice>
        <choice value="BLTMMD*" OR "WASHDC*">site_1</choice>
        <choice value="BFLONY*" OR "FLSHNY*">site_2</choice>
        <initialValue>*</initialValue>
    </input>
0 Karma
1 Solution

davpx
Communicator

How about this?

<input type="dropdown" token="location">
         <label>location</label>
         <choice value="*">ALL</choice>
         <choice value="BLTMMD* OR WASHDC*">site_1</choice>
         <choice value="BFLONY* OR FLSHNY*">site_2</choice>
         <initialValue>*</initialValue>
     </input>

View solution in original post

0 Karma

marycordova
SplunkTrust
SplunkTrust

Here is what this looks like in the finished Dashboard:
alt text

@marycordova
0 Karma

marycordova
SplunkTrust
SplunkTrust

Assuming you have a dashboard and you want to provide a dropdown that defaults to everything or allows the user to select an OR separated list of possible values you could use the following:

  </search>
  <fieldForLabel>title</fieldForLabel>
  <fieldForValue>id</fieldForValue>
  <default>*</default>
  <valuePrefix>scenario_id="</valuePrefix>
  <valueSuffix>"</valueSuffix>
  <delimiter> OR </delimiter>

This is what this looks like in the WebUI:
alt text
alt text

@marycordova
0 Karma

kwanx
Explorer

hi marycordovacaa - this looks like it would work as well if I had many "OR" statements - this this case i have only 2 OR 3 per site (and only 9 sites) so since my options are simple, will go with davpx solution above, but will keep yours in mind if i have a more complex matrix of options.

Thx for the reply!

0 Karma

davpx
Communicator

How about this?

<input type="dropdown" token="location">
         <label>location</label>
         <choice value="*">ALL</choice>
         <choice value="BLTMMD* OR WASHDC*">site_1</choice>
         <choice value="BFLONY* OR FLSHNY*">site_2</choice>
         <initialValue>*</initialValue>
     </input>
0 Karma

kwanx
Explorer

davpx - thx for the reply, this worked! I was close, just wrong syntax 🙂

Thanks again!

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...