Dashboards & Visualizations

[Sideview] Pulldown chain with interactive dynamic lookups

Laszlo_K
Explorer

I tried to build a multiple filter and each selected value should filter the other 3 filter's value lists, no matter in which order the filters are used. This worked with a simple XML dashboard and a bunch of post-processing searches.
Being a beginner with Sideview, I used a pulldown chain and it works only downstream, as expected 🙂
What should I change to have the desired functionality?
Thank you.

The pulldown chain:

  <param name="name">field1</param>
  <param name="label">Select field1</param>
  <param name="template">field1="$value$"</param>
  <param name="float">left</param>
  <param name="postProcess">|search $field2$ $field3$ $field4$ | dedup $name$ | sort $name$</param>
  <param name="valueField">$name$</param>
  <module name="Pulldown">
    <param name="name">field2</param>
    <param name="label">Select field2</param>
    <param name="template">field2="$value$"</param>
    <param name="float">left</param>
    <param name="postProcess">|search $field1$ $field3$ $field4$ | dedup $name$ | sort $name$</param>
    <param name="valueField">$name$</param>
    <module name="Pulldown">
      <param name="name">field3</param>
      <param name="label">Select field3</param>
      <param name="template">field3="$value$"</param>
      <param name="float">left</param>
      <param name="postProcess">| search $field1$ $field2$ $field4$ | dedup $name$ | sort $name$</param>
      <param name="valueField">$name$</param>
      <module name="Pulldown">
        <param name="name">field4</param>
        <param name="label">Select field4</param>
        <param name="template">field4="$value$"</param>
        <param name="float">left</param>
        <param name="postProcess">| search $field1$ $field2$ $field4$ | dedup $name$ | sort $name$</param>
        <param name="valueField">$name$</param>

        <module name="Search" layoutPanel="panel_row1_col1" autoRun="False">
           <param name="search"><![CDATA[ $search$ | search $field1$ $field2$ $field3$ $field4$ ]]></param>

          <module name="Pager">

             <module name="Table">
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...