Need to fetch the results dynamically from the dropdown using eval condition

[sbollam]

Hello All,

I have a requirement on the dropdowns, I have a following lookup file which contains application, environment and index details, I need to get the environment details related to each application when i choose app details from the dropdown, similarly with the index dropdown, it must only give the index details based on the values that i choose in the application and environment dropdowns. I could get the desired results while using the lookup file.

But how can this be achieved using eval condition in the splunk dashboard rather than using the lookup file. I have the values of the fields in the splunk results.

application	environment	index
app_a	DEV	aws-app_a_npd
app_a	PPR	aws-app_a_ppr
app_a	TEST	aws-app_a_test
app_a	SUP	aws-app_a_sup
app_a	PROD	aws-app_a_prod
app_b	NPD	aws-app_b_npd
app_b	SUP	aws-app_b_sup
app_b	PROD	aws-app_b_prod
app_c	NPD	aws-app_c_npd
app_c	SUP	aws-app_c_sup
app_c	PROD	aws-app_c_prod

[gcusello]

Hi @sbollam ,

you have to create three cascade dropdown list, concatenated uing the tokens of the previous ones, something like this:

  <fieldset submitButton="false">
    <input type="dropdown" token="application">
      <label>Application</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>Application</fieldForLabel>
      <fieldForValue>Application</fieldForValue>
      <search>
        <query>
           | inputlookup my_lookup.csv
           | dedup Application
           | sort Application
           | table Application
        </query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="dropdown" token="environment">
      <label>Environment</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>Environment</fieldForLabel>
      <fieldForValue>Environment</fieldForValue>
      <search>
        <query>
           | inputlookup my_lookup.csv WHERE Application=$application$
           | dedup Environment
           | sort Environment
           | table Environment
        </query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="dropdown" token="index">
      <label>index</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>index</fieldForLabel>
      <fieldForValue>index</fieldForValue>
      <search>
        <query>
           | inputlookup my_lookup.csv WHERE Application=$application$ AND index=$index$
           | dedup index
           | sort index
           | table index
        </query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>

Ciao.

Giuseppe