Dashboards & Visualizations

Populate second drop down based on first drop down selection ?

vikas_gopal
Builder

Hi Experts,

I have one static drop down , it has 2 static value "stage and Prod". Now I want to display values in the second drop down based on first drop down selection . So second drop down shows staging servers only if first selection was stage and vice versa.

to be more specific
If Drop down 1 = stage
Drop down 2 = abc_stage1,abc_stage2 (using a query )

IF Drop down 2 = prod
Drop down 2 = abc_prod1,abc_prod2 (using a query )

Please help

VG

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

How do you know that a server is staging or prod?
Typically there is a naming convention...

Let's assume production servers have the letter P as the third character:

aaPxxx <-prod
aaSxxx <- staging

Now your first drop down has value P for Production and value S for staging and env is the name of the token.

In your second drop down you would populate it with this search:

 index=AIndexWithAllHosts | dedup host | rex field=host "..($<env>.)" | search env=$env$ | fields host | sort host

And you use host as the field for the values.

View solution in original post

DDivagarInfant
Engager

Can you share the soluition?

0 Karma

woodcock
Esteemed Legend

I agree with the other answer but to answer your literal question, try code like this:

<input type="text" token="server_partial" searchWhenChanged="false">
    <label>RegEx filter for Server Dropdown --&gt;</label>
    <default>.</default>
</input>
<input type="dropdown" token="server" searchWhenChanged="false">
    <label>(&lt;-- filtered) Server Selector:</label>
    <default>*</default>
    <choice value="*">All</choice>
    <fieldForLabel>server</fieldForLabel>
    <fieldForValue>server</fieldForValue>
    <search>
        <query>| inputcsv serverlist.csv | regex server="(?i)$server_partial$" | table server</query>
        <earliest>-1s</earliest>
        <latest>now</latest>
    </search>
</input>
0 Karma

vikas_gopal
Builder

I can see all staging servers have stage string in it and all prod has prod string in the server name .

0 Karma

jkat54
SplunkTrust
SplunkTrust

How do you know that a server is staging or prod?
Typically there is a naming convention...

Let's assume production servers have the letter P as the third character:

aaPxxx <-prod
aaSxxx <- staging

Now your first drop down has value P for Production and value S for staging and env is the name of the token.

In your second drop down you would populate it with this search:

 index=AIndexWithAllHosts | dedup host | rex field=host "..($<env>.)" | search env=$env$ | fields host | sort host

And you use host as the field for the values.

vikas_gopal
Builder

Thank you Man,

Works like charm.

jkat54
SplunkTrust
SplunkTrust

A lot of people prefer to use | metadata type=hosts instead of index=AIndexWithAllHosts

0 Karma

vikas_gopal
Builder

Got another situation , now I am preparing a table based on above 2 inputs . When it is stage + All in second I want to see only stage servers in the table below . What it is doing in table is, it is giving me overall servers details that is for both stage and prod . For table I tried this but with this no data appears

index=abc  source=computer host=$host$ $env$| sort Name  |table Name,Domain, Manufacturer, Model|dedup Name,Domain, Manufacturer, Mode

I know this is because of $env$ as it is searching for P or S.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...