Dashboards & Visualizations

Multiple dropdowns using multiple searches and passing the tokens into single dashboard panel

sandeepsplunk01
New Member

There are 4 dropdowns

D1 D2 D3 D4

All are having unique searches and I want to pass the data accordingly into the single panel.

Ex: D1 dropdown using index=A, D2 using index=B, D3 using index=C as a base search.

Now when user select any value in D1 dropdown, then data is reflect into single panel and when D2 dropdwon selected then D2 token data should pass into the same panel.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sandeepsplunk019,
let me understand, have you a search like this?

(index=A field1=$D1$) OR (index=B field2=$D2$) OR (index=C field3=$D3$) OR (index=D field4=$D4$)
| stats count

The only problem is to define the default values for each dropdown (e.g. * for all).

Put attention if the for partial searches (e.g. index=A $D1$) the field that you used for the dropdown is present in all the events, because using * as default value if you have events without field1 they are excluded from the results.

Ciao.
Giuseppe

0 Karma

sandeepsplunk01
New Member

Hello Gcusella,

Thanks for the response.

Your understanding is correct but challenge for me is to show the data based on dropdown token into the same panel.

Example: DropdownA search(Token LM1): index=A | stats count by L1,

DropdownA search(Token LM2): index=A $LM1$| stats count by L2,
DropdownA search(Token LM3): index=A $LM2$| stats count by L3,
DropdownA search(Token LM4): index=A $LM3$| stats count by L3.

When I select DropdownA , panel should Field L1 AND When I select DropdownB , same panel should display only Field L2.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sandeepsplunk019,
sorry but I don't understand:
what's LMx and what's the difference with Lx?
if the four examples are the searches of the dropdowns, what's the search in the panel??

Ciao.
Giuseppe

0 Karma

sandeepsplunk01
New Member

LM is the token name and L is the field name.

Search in the panel is

Index=* (L1=$LM1$ AND L2=$LM2$ AND L3=$LM3$ AND L4=$LM4$)

| stats count by L1 L2 L3 L4 Utilization

When I click on Dropdown A and select L1 value then I'm expecting the search in the panel would be index=* (LM1=$selected token$ AND LM2=$L2$ AND LM3=$L3$ AND LM4=$L4$) | stats count by LM1 utilization

When I click on Dropdown B and select L2 value then I'm expecting the search in the panel would be index=* (LM1=$L1$ AND LM2=$Lselected token$ AND LM3=$L3$ AND LM4=$L4$) | stats count by LM2 utilization

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...