- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Splunkers,
I'm new to Splunk and trying to create a form to narrow down the search to a specific selected dropdown value on the form.
Requirement :
Select the first dropdown it populates the second dropdown.(Works fine up till here)
My idea is upon selection of the value populated in that second dropdown, I want to execute a search in the panel below(transactions) and produce the search result.
Issue: Upon selection of the second dropdown, the search does not get executed. but when I remove the value in the second dropdown(change) the search is executed and the result appears for my previous search which is not on display anymore.
please help!!!!
heres my forms partial xml below:
<form>
<label>Test_me</label>
<description>Splunk</description>
<fieldset submitButton="true" autoRun="true">
<input type="dropdown" token="trackingparam1" searchWhenChanged="false">
<label>Choose Tracking Parameter 1</label>
<search>
<query>some query to pupulate the drop down</query>
</search>
<fieldForLabel>column</fieldForLabel>
<fieldForValue>column</fieldForValue>
<choice value="All">All</choice>
<change>
<unset token="form.trackingval1"></unset>
<condition value="All">
<set token="queryString"></set>
</condition>
<condition>
<set token="queryString">$trackingparam1$="All"</set>
</condition>
</change>
<default>All</default>
<initialValue>All</initialValue>
</input>
<input type="dropdown" token="trackingval1" searchWhenChanged="false">
<label>Enter Parameter Value 1</label>
<fieldForLabel>Choose Tracking Parameter 1</fieldForLabel>
<fieldForValue>$trackingparam1$</fieldForValue>
<change>
<condition>
**<set token="queryString">$trackingparam1$="$trackingval1$"</set>**(need to execute this upon dropdown selection rather than change)
</condition>
</change>
<search>
<query>index=some query to pupulate the dropdown</query>
</search>
<choice value="*">All</choice>
</input> </fieldset> <row>
<panel>
<title>Transactions</title>
<table>
<search>
<query>index="test" Source="$field$" $queryString$|table TransactionId Name Source Target Status Details
_time</query>
<earliest>$field6.earliest$</earliest>
<latest>$field6.latest$</latest>
</search>
<option name="drilldown">row</option>
<!-- disable the search option for results -->
<option name="link.openSearch.visible">0</option>
<option name="rowNumbers">true</option>
<format type="color" field="Status">
<colorPalette type="map">{"Success":#65A637,"Error":#D93F3C}</colorPalette>
</format>
<fields>["Name","Source","Target","Status","Details","_time"]</fields>
<!-- src_tranid is the field to be drilled down on -->
<drilldown>
<set token="src_tranid">$row.TransactionId$</set>
<set token="src_date">$row.CreatedAt.$date$</set>
</drilldown>
</table>
</panel>
</row>
</form>
Thanks in advance,
buddingsplunker
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

If I'm reading this right, you may be able to get away with not using that queryString token at all. So remove it from both of your inputs. Instead, in your dashboard panel replace $queryString$ with what you were setting it to
index="test" Source="$field$" $trackingparam1$="$trackingval1$"
|table TransactionId Name Source Target Status Details
Now if you set your dropdowns both to "search on change", I think the panel will update as expected.
If the second dropdown is changed, the search should rerun with the update trackingval1 token. If the first dropdown is changed, trackingval1 will be unset, the second dropdown should repopulate, the default choice will be selected, trackingval1 will get set again and the search panel should update accordingly.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

If I'm reading this right, you may be able to get away with not using that queryString token at all. So remove it from both of your inputs. Instead, in your dashboard panel replace $queryString$ with what you were setting it to
index="test" Source="$field$" $trackingparam1$="$trackingval1$"
|table TransactionId Name Source Target Status Details
Now if you set your dropdowns both to "search on change", I think the panel will update as expected.
If the second dropdown is changed, the search should rerun with the update trackingval1 token. If the first dropdown is changed, trackingval1 will be unset, the second dropdown should repopulate, the default choice will be selected, trackingval1 will get set again and the search panel should update accordingly.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you maciep,
It worked like a charm.
