Dashboards & Visualizations

[Sideview] Pulldown chain with interactive dynamic lookups

Laszlo_K
Explorer

I tried to build a multiple filter and each selected value should filter the other 3 filter's value lists, no matter in which order the filters are used. This worked with a simple XML dashboard and a bunch of post-processing searches.
Being a beginner with Sideview, I used a pulldown chain and it works only downstream, as expected 🙂
What should I change to have the desired functionality?
Thank you.

The pulldown chain:

  <param name="name">field1</param>
  <param name="label">Select field1</param>
  <param name="template">field1="$value$"</param>
  <param name="float">left</param>
  <param name="postProcess">|search $field2$ $field3$ $field4$ | dedup $name$ | sort $name$</param>
  <param name="valueField">$name$</param>
  <module name="Pulldown">
    <param name="name">field2</param>
    <param name="label">Select field2</param>
    <param name="template">field2="$value$"</param>
    <param name="float">left</param>
    <param name="postProcess">|search $field1$ $field3$ $field4$ | dedup $name$ | sort $name$</param>
    <param name="valueField">$name$</param>
    <module name="Pulldown">
      <param name="name">field3</param>
      <param name="label">Select field3</param>
      <param name="template">field3="$value$"</param>
      <param name="float">left</param>
      <param name="postProcess">| search $field1$ $field2$ $field4$ | dedup $name$ | sort $name$</param>
      <param name="valueField">$name$</param>
      <module name="Pulldown">
        <param name="name">field4</param>
        <param name="label">Select field4</param>
        <param name="template">field4="$value$"</param>
        <param name="float">left</param>
        <param name="postProcess">| search $field1$ $field2$ $field4$ | dedup $name$ | sort $name$</param>
        <param name="valueField">$name$</param>

        <module name="Search" layoutPanel="panel_row1_col1" autoRun="False">
           <param name="search"><![CDATA[ $search$ | search $field1$ $field2$ $field3$ $field4$ ]]></param>

          <module name="Pager">

             <module name="Table">
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...