Dashboards & Visualizations

Use a value selected in a form to run a search in separate dashboard panel?

vravisplunker
Explorer

Hi Splunkers,
I'm new to Splunk and trying to create a form to narrow down the search to a specific selected dropdown value on the form.
Requirement :
Select the first dropdown it populates the second dropdown.(Works fine up till here)
My idea is upon selection of the value populated in that second dropdown, I want to execute a search in the panel below(transactions) and produce the search result.

Issue: Upon selection of the second dropdown, the search does not get executed. but when I remove the value in the second dropdown(change) the search is executed and the result appears for my previous search which is not on display anymore.
please help!!!!
heres my forms partial xml below:

 <form>  
<label>Test_me</label>  
 <description>Splunk</description>  
 <fieldset submitButton="true" autoRun="true">
          <input type="dropdown" token="trackingparam1" searchWhenChanged="false">
          <label>Choose Tracking Parameter 1</label>
          <search>
            <query>some query to pupulate the drop down</query>
          </search>
          <fieldForLabel>column</fieldForLabel>
          <fieldForValue>column</fieldForValue>
          <choice value="All">All</choice>
          <change>
            <unset token="form.trackingval1"></unset>
            <condition value="All">
              <set token="queryString"></set>
            </condition>
            <condition>
              <set token="queryString">$trackingparam1$="All"</set>
            </condition>
          </change>
          <default>All</default>
          <initialValue>All</initialValue>
        </input>
        <input type="dropdown" token="trackingval1" searchWhenChanged="false">
          <label>Enter Parameter Value 1</label>
          <fieldForLabel>Choose Tracking Parameter 1</fieldForLabel>
          <fieldForValue>$trackingparam1$</fieldForValue>
          <change>
            <condition>
            **<set token="queryString">$trackingparam1$="$trackingval1$"</set>**(need to execute this upon dropdown selection rather than change)
          </condition>
          </change>
          <search>
            <query>index=some query to pupulate the dropdown</query>
          </search>
          <choice value="*">All</choice>
        </input>   </fieldset>  <row>
        <panel>
          <title>Transactions</title>
          <table>
            <search>
              <query>index="test"  Source="$field$" $queryString$|table TransactionId Name Source Target Status Details
    _time</query>
              <earliest>$field6.earliest$</earliest>
              <latest>$field6.latest$</latest>
            </search>
            <option name="drilldown">row</option>
            <!-- disable the search option for results -->
            <option name="link.openSearch.visible">0</option>
            <option name="rowNumbers">true</option>
            <format type="color" field="Status">
              <colorPalette type="map">{"Success":#65A637,"Error":#D93F3C}</colorPalette>
            </format>
            <fields>["Name","Source","Target","Status","Details","_time"]</fields>
            <!-- src_tranid is the field to be drilled down on -->
            <drilldown>
              <set token="src_tranid">$row.TransactionId$</set>
              <set token="src_date">$row.CreatedAt.$date$</set>
            </drilldown>
          </table>
        </panel>
</row> 
</form>

Thanks in advance,
buddingsplunker

0 Karma
1 Solution

maciep
Champion

If I'm reading this right, you may be able to get away with not using that queryString token at all. So remove it from both of your inputs. Instead, in your dashboard panel replace $queryString$ with what you were setting it to

index="test" Source="$field$" $trackingparam1$="$trackingval1$"
|table TransactionId Name Source Target Status Details

Now if you set your dropdowns both to "search on change", I think the panel will update as expected.

If the second dropdown is changed, the search should rerun with the update trackingval1 token. If the first dropdown is changed, trackingval1 will be unset, the second dropdown should repopulate, the default choice will be selected, trackingval1 will get set again and the search panel should update accordingly.

View solution in original post

maciep
Champion

If I'm reading this right, you may be able to get away with not using that queryString token at all. So remove it from both of your inputs. Instead, in your dashboard panel replace $queryString$ with what you were setting it to

index="test" Source="$field$" $trackingparam1$="$trackingval1$"
|table TransactionId Name Source Target Status Details

Now if you set your dropdowns both to "search on change", I think the panel will update as expected.

If the second dropdown is changed, the search should rerun with the update trackingval1 token. If the first dropdown is changed, trackingval1 will be unset, the second dropdown should repopulate, the default choice will be selected, trackingval1 will get set again and the search panel should update accordingly.

vravisplunker
Explorer

Thank you maciep,
It worked like a charm.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...