Dashboards & Visualizations

Use Single Dropdown Choice to Display Mulitple Reports in a Single Row?

dfutrick
Engager

I've figured out how to display a single Report in a row/panel based on a users dropdown choice

 

<row>
<panel>
<title>Vuln Totals - Last 30 Days</title>
<input type="dropdown" searchWhenChanged="true" token="field1">
<label>Machine Classification</label>
<choice value="WorkStation_Report_1">Workstations</choice>
<choice value="DataCenter_Report_1">DataCenter</choice>
<choice value="DMZ_Report_1">DMZ</choice>
<default>WorkStation_Report_1</default>
</input>
<chart>
<search ref="$field1$"></search>
</chart>
</panel>
</row>

 


However, I'd like to take the users choice/token and use it to display 3 Reports side by side (instead of just one).

 

<row>
    <panel>
      <table>
        <title>Top 5 Vulns</title>
        <search ref="WorkStation_Report_1"></search>
      </table>
    </panel>
    <panel>
      <table>
        <title>Top 5 IPs</title>
        <search ref="WorkStation_Report_2"></search>
      </table>
    </panel>
    <panel>
      <table>
        <title>Top 5 Overdue</title>
        <search ref="WorkStation_Report_3"></search>
      </table>
    </panel>
  </row>

 

 

Does anyone know if this is possible or more importantly, how to achieve it?

Thanks!

Dashboard_Multiple_Reports_Populated_By_Single_Dropdown_Choice_Displayed_In_SIngle_Row.PNG

Labels (4)
0 Karma
1 Solution

dfutrick
Engager

As stand-alone code it worked but what I was trying to do was to get the 3 reports to change based on the choice made in the dropdown.  In fact, I just figured out that part right before I saw your post.

The solution I landed on is this. I'll use a different prefix for each report type, define that prefix as my "choice value=", and then call that out in the search tag within each table, and append it to the 3 report names.  

This code achieves what I was trying to do.

 

<row>
<panel>
<title>Top Fives - Last 7 Days</title>
<input type="dropdown" searchWhenChanged="true" token="field1">
<label>Machine Classification</label>
<choice value="CYB_Test">Workstations</choice>
<choice value="DC_Test">DataCenter_All</choice>
</input>
</panel>
</row>
<row>
<panel>
<table>
<title>Table 1</title>
<search ref="$field1$_1"></search>
</table>
</panel>
<panel>
<table>
<title>Table 2</title>
<search ref="$field1$_2"></search>
</table>
</panel>
<panel>
<table>
<title>Table 3</title>
<search ref="$field1$_3"></search>
</table>
</panel>
</row>

 

View solution in original post

0 Karma

dfutrick
Engager

As stand-alone code it worked but what I was trying to do was to get the 3 reports to change based on the choice made in the dropdown.  In fact, I just figured out that part right before I saw your post.

The solution I landed on is this. I'll use a different prefix for each report type, define that prefix as my "choice value=", and then call that out in the search tag within each table, and append it to the 3 report names.  

This code achieves what I was trying to do.

 

<row>
<panel>
<title>Top Fives - Last 7 Days</title>
<input type="dropdown" searchWhenChanged="true" token="field1">
<label>Machine Classification</label>
<choice value="CYB_Test">Workstations</choice>
<choice value="DC_Test">DataCenter_All</choice>
</input>
</panel>
</row>
<row>
<panel>
<table>
<title>Table 1</title>
<search ref="$field1$_1"></search>
</table>
</panel>
<panel>
<table>
<title>Table 2</title>
<search ref="$field1$_2"></search>
</table>
</panel>
<panel>
<table>
<title>Table 3</title>
<search ref="$field1$_3"></search>
</table>
</panel>
</row>

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The code you have (3 <panel> elements within a <row> element) should work.  Have you tried it?  What were the results?

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...