Am very new to Splunk.
I have a dashboard with 2 drop-downs.
First drop-down contains hostnames like host1, host2
If I select the host1, then the input for the 2 drop-down must be queary1 and it will display the process names.
if I select the host2, then the input for the 2 drop-down must be queary2 and it will display the logs.
Dropdown1 Dropdown2 host1 ----- value1,value2, value3 earliest=-2d host=$host$ Process=AB_* host ----- value4,value5, value6 host=$host$ source=*
What is the simple xml code for this?
So you want to populate dropdown 2 with list of distinct 'Process' if host1 (hardcoded value) is selected and populate with list of distinct 'source if host2 is selected? Are you using the value of dropdown1 (host) anywhere else in the dashboard OR it's only used to determine content of dropdown2?
Hi, am using the host(dropdown1) in almost all the dashboard panels, also am using the process and source also in all panels.
Give this a try. Dropdown1 will have static/hardcoded host name. Once change of selection of dropdown1, it will set another token with query to be executed in dropdown2, based on selected host (double-check the queries). The dropdown2 will the run the query set by dropdown1, in conjunction with selected host and return a valueField column whose values will be shown in dropdown2. You can now use $host$ from dropdown1 and $dropdown2_tok$ from dropdown2 (you can change the name of token per your need).
<form> <label>Use tokens with conditional input choices</label> <fieldset submitButton="false"> <input type="dropdown" token="host"> <label>Host</label> <choice value="host1">host1</choice> <choice value="host2">host2</choice> <default>host1</default> <change> <condition label="host1"> <set token="dropdown2_query">earliest=-2d Process=AB_*| stats count by Process | table Process| rename Process as valueField </set> </condition> <condition label="host2"> <set token="dropdown2_query"> source=* | stats count by source | table source | rename source as valueField</set> </condition> </change> </input> <input type="dropdown" token="dropdown2_tok"> <label>Some Label Here</label> <selectFirstChoice>true</selectFirstChoice> <search> <query> host=$host$ $dropdown2_query$ </query> <earliest>-7d</earliest> <latest>-0d</latest> </search> <fieldForLabel>valueField<fieldForLabel> <fieldForValue>valueField<fieldForValue> </input> </fieldset> ...rest of the dashboard...