Dashboards & Visualizations

Populate second drop down based on first drop down selection ?

vikas_gopal
Builder

Hi Experts,

I have one static drop down , it has 2 static value "stage and Prod". Now I want to display values in the second drop down based on first drop down selection . So second drop down shows staging servers only if first selection was stage and vice versa.

to be more specific
If Drop down 1 = stage
Drop down 2 = abc_stage1,abc_stage2 (using a query )

IF Drop down 2 = prod
Drop down 2 = abc_prod1,abc_prod2 (using a query )

Please help

VG

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

How do you know that a server is staging or prod?
Typically there is a naming convention...

Let's assume production servers have the letter P as the third character:

aaPxxx <-prod
aaSxxx <- staging

Now your first drop down has value P for Production and value S for staging and env is the name of the token.

In your second drop down you would populate it with this search:

 index=AIndexWithAllHosts | dedup host | rex field=host "..($<env>.)" | search env=$env$ | fields host | sort host

And you use host as the field for the values.

View solution in original post

DDivagarInfant
Engager

Can you share the soluition?

0 Karma

woodcock
Esteemed Legend

I agree with the other answer but to answer your literal question, try code like this:

<input type="text" token="server_partial" searchWhenChanged="false">
    <label>RegEx filter for Server Dropdown --&gt;</label>
    <default>.</default>
</input>
<input type="dropdown" token="server" searchWhenChanged="false">
    <label>(&lt;-- filtered) Server Selector:</label>
    <default>*</default>
    <choice value="*">All</choice>
    <fieldForLabel>server</fieldForLabel>
    <fieldForValue>server</fieldForValue>
    <search>
        <query>| inputcsv serverlist.csv | regex server="(?i)$server_partial$" | table server</query>
        <earliest>-1s</earliest>
        <latest>now</latest>
    </search>
</input>
0 Karma

vikas_gopal
Builder

I can see all staging servers have stage string in it and all prod has prod string in the server name .

0 Karma

jkat54
SplunkTrust
SplunkTrust

How do you know that a server is staging or prod?
Typically there is a naming convention...

Let's assume production servers have the letter P as the third character:

aaPxxx <-prod
aaSxxx <- staging

Now your first drop down has value P for Production and value S for staging and env is the name of the token.

In your second drop down you would populate it with this search:

 index=AIndexWithAllHosts | dedup host | rex field=host "..($<env>.)" | search env=$env$ | fields host | sort host

And you use host as the field for the values.

vikas_gopal
Builder

Thank you Man,

Works like charm.

jkat54
SplunkTrust
SplunkTrust

A lot of people prefer to use | metadata type=hosts instead of index=AIndexWithAllHosts

0 Karma

vikas_gopal
Builder

Got another situation , now I am preparing a table based on above 2 inputs . When it is stage + All in second I want to see only stage servers in the table below . What it is doing in table is, it is giving me overall servers details that is for both stage and prod . For table I tried this but with this no data appears

index=abc  source=computer host=$host$ $env$| sort Name  |table Name,Domain, Manufacturer, Model|dedup Name,Domain, Manufacturer, Mode

I know this is because of $env$ as it is searching for P or S.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...