Dashboards & Visualizations

Multiple multiselects and panels

paviach
New Member

I have 3 multiselects and each dependent on one-another.
The third multiselect should display panels based on the selection.
How do I give multiple query and conditions?

eg.,
Multiselect A
Multiselect B is dependent on A
Multiselect C is dependent on B

Panel 1 is dependent on C's selection.

Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi paviach
you have to create the searches of multiselect B and C as a search with a token from the previous multiselects, e.g. something like this:

Multiselect A (there's a field called fieldA):

| inputlookup lookupA.csv
| sort fieldA
| table fieldA

Multiselect B (there are two fields called fieldB and keyB, where keyB is the field related to Multiselect A):

| inputlookup lookupB.csv WHERE keyB=$fieldA$
| sort fieldB
| table fieldB

Multiselect C (there are three fields called fieldC, keyCA and keyCB, where keyCA is the field related to Multiselect A and keyCB is the field related to Multiselect B):

| inputlookup lookupC.csv WHERE (keyCA=$fieldA$ AND keyCB=$fieldB$)
| sort fieldC
| table fieldC

Ciao.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi paviach
you have to create the searches of multiselect B and C as a search with a token from the previous multiselects, e.g. something like this:

Multiselect A (there's a field called fieldA):

| inputlookup lookupA.csv
| sort fieldA
| table fieldA

Multiselect B (there are two fields called fieldB and keyB, where keyB is the field related to Multiselect A):

| inputlookup lookupB.csv WHERE keyB=$fieldA$
| sort fieldB
| table fieldB

Multiselect C (there are three fields called fieldC, keyCA and keyCB, where keyCA is the field related to Multiselect A and keyCB is the field related to Multiselect B):

| inputlookup lookupC.csv WHERE (keyCA=$fieldA$ AND keyCB=$fieldB$)
| sort fieldC
| table fieldC

Ciao.
Giuseppe

paviach
New Member

I have created 2 multiselects and the 2nd works with 1st multiselect's input. Now based on B's selection, I need to display a panel. How do I do it?

0 Karma

paviach
New Member

Could you please give me a working sample? Am completely new to Splunk and trying hard to make this multiselect work for panels.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi paviach
try this, only to see the approach:

<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="input1">
      <label>Input1</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_internal | dedup sourcetype | sort sourcetype | table sourcetype</query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <prefix>sourcetype="</prefix>
      <suffix>"</suffix>
    </input>
    <input type="dropdown" token="input2">
      <label>Input2</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>component</fieldForLabel>
      <fieldForValue>component</fieldForValue>
      <search>
        <query>index=_internal $input1$ | dedup component | sort component | table component</query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <prefix>component="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>index=_internal $input1$ $input2$</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="list.drilldown">none</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.sortDirection">asc</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
      </event>
    </panel>
  </row>
</form>

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...