Dashboards & Visualizations

Use Single Dropdown Choice to Display Mulitple Reports in a Single Row?

dfutrick
Engager

I've figured out how to display a single Report in a row/panel based on a users dropdown choice

 

<row>
<panel>
<title>Vuln Totals - Last 30 Days</title>
<input type="dropdown" searchWhenChanged="true" token="field1">
<label>Machine Classification</label>
<choice value="WorkStation_Report_1">Workstations</choice>
<choice value="DataCenter_Report_1">DataCenter</choice>
<choice value="DMZ_Report_1">DMZ</choice>
<default>WorkStation_Report_1</default>
</input>
<chart>
<search ref="$field1$"></search>
</chart>
</panel>
</row>

 


However, I'd like to take the users choice/token and use it to display 3 Reports side by side (instead of just one).

 

<row>
    <panel>
      <table>
        <title>Top 5 Vulns</title>
        <search ref="WorkStation_Report_1"></search>
      </table>
    </panel>
    <panel>
      <table>
        <title>Top 5 IPs</title>
        <search ref="WorkStation_Report_2"></search>
      </table>
    </panel>
    <panel>
      <table>
        <title>Top 5 Overdue</title>
        <search ref="WorkStation_Report_3"></search>
      </table>
    </panel>
  </row>

 

 

Does anyone know if this is possible or more importantly, how to achieve it?

Thanks!

Dashboard_Multiple_Reports_Populated_By_Single_Dropdown_Choice_Displayed_In_SIngle_Row.PNG

Labels (4)
0 Karma
1 Solution

dfutrick
Engager

As stand-alone code it worked but what I was trying to do was to get the 3 reports to change based on the choice made in the dropdown.  In fact, I just figured out that part right before I saw your post.

The solution I landed on is this. I'll use a different prefix for each report type, define that prefix as my "choice value=", and then call that out in the search tag within each table, and append it to the 3 report names.  

This code achieves what I was trying to do.

 

<row>
<panel>
<title>Top Fives - Last 7 Days</title>
<input type="dropdown" searchWhenChanged="true" token="field1">
<label>Machine Classification</label>
<choice value="CYB_Test">Workstations</choice>
<choice value="DC_Test">DataCenter_All</choice>
</input>
</panel>
</row>
<row>
<panel>
<table>
<title>Table 1</title>
<search ref="$field1$_1"></search>
</table>
</panel>
<panel>
<table>
<title>Table 2</title>
<search ref="$field1$_2"></search>
</table>
</panel>
<panel>
<table>
<title>Table 3</title>
<search ref="$field1$_3"></search>
</table>
</panel>
</row>

 

View solution in original post

0 Karma

dfutrick
Engager

As stand-alone code it worked but what I was trying to do was to get the 3 reports to change based on the choice made in the dropdown.  In fact, I just figured out that part right before I saw your post.

The solution I landed on is this. I'll use a different prefix for each report type, define that prefix as my "choice value=", and then call that out in the search tag within each table, and append it to the 3 report names.  

This code achieves what I was trying to do.

 

<row>
<panel>
<title>Top Fives - Last 7 Days</title>
<input type="dropdown" searchWhenChanged="true" token="field1">
<label>Machine Classification</label>
<choice value="CYB_Test">Workstations</choice>
<choice value="DC_Test">DataCenter_All</choice>
</input>
</panel>
</row>
<row>
<panel>
<table>
<title>Table 1</title>
<search ref="$field1$_1"></search>
</table>
</panel>
<panel>
<table>
<title>Table 2</title>
<search ref="$field1$_2"></search>
</table>
</panel>
<panel>
<table>
<title>Table 3</title>
<search ref="$field1$_3"></search>
</table>
</panel>
</row>

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The code you have (3 <panel> elements within a <row> element) should work.  Have you tried it?  What were the results?

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...