Dashboards & Visualizations

Use a value selected in a form to run a search in separate dashboard panel?

vravisplunker
Explorer

Hi Splunkers,
I'm new to Splunk and trying to create a form to narrow down the search to a specific selected dropdown value on the form.
Requirement :
Select the first dropdown it populates the second dropdown.(Works fine up till here)
My idea is upon selection of the value populated in that second dropdown, I want to execute a search in the panel below(transactions) and produce the search result.

Issue: Upon selection of the second dropdown, the search does not get executed. but when I remove the value in the second dropdown(change) the search is executed and the result appears for my previous search which is not on display anymore.
please help!!!!
heres my forms partial xml below:

 <form>  
<label>Test_me</label>  
 <description>Splunk</description>  
 <fieldset submitButton="true" autoRun="true">
          <input type="dropdown" token="trackingparam1" searchWhenChanged="false">
          <label>Choose Tracking Parameter 1</label>
          <search>
            <query>some query to pupulate the drop down</query>
          </search>
          <fieldForLabel>column</fieldForLabel>
          <fieldForValue>column</fieldForValue>
          <choice value="All">All</choice>
          <change>
            <unset token="form.trackingval1"></unset>
            <condition value="All">
              <set token="queryString"></set>
            </condition>
            <condition>
              <set token="queryString">$trackingparam1$="All"</set>
            </condition>
          </change>
          <default>All</default>
          <initialValue>All</initialValue>
        </input>
        <input type="dropdown" token="trackingval1" searchWhenChanged="false">
          <label>Enter Parameter Value 1</label>
          <fieldForLabel>Choose Tracking Parameter 1</fieldForLabel>
          <fieldForValue>$trackingparam1$</fieldForValue>
          <change>
            <condition>
            **<set token="queryString">$trackingparam1$="$trackingval1$"</set>**(need to execute this upon dropdown selection rather than change)
          </condition>
          </change>
          <search>
            <query>index=some query to pupulate the dropdown</query>
          </search>
          <choice value="*">All</choice>
        </input>   </fieldset>  <row>
        <panel>
          <title>Transactions</title>
          <table>
            <search>
              <query>index="test"  Source="$field$" $queryString$|table TransactionId Name Source Target Status Details
    _time</query>
              <earliest>$field6.earliest$</earliest>
              <latest>$field6.latest$</latest>
            </search>
            <option name="drilldown">row</option>
            <!-- disable the search option for results -->
            <option name="link.openSearch.visible">0</option>
            <option name="rowNumbers">true</option>
            <format type="color" field="Status">
              <colorPalette type="map">{"Success":#65A637,"Error":#D93F3C}</colorPalette>
            </format>
            <fields>["Name","Source","Target","Status","Details","_time"]</fields>
            <!-- src_tranid is the field to be drilled down on -->
            <drilldown>
              <set token="src_tranid">$row.TransactionId$</set>
              <set token="src_date">$row.CreatedAt.$date$</set>
            </drilldown>
          </table>
        </panel>
</row> 
</form>

Thanks in advance,
buddingsplunker

0 Karma
1 Solution

maciep
Champion

If I'm reading this right, you may be able to get away with not using that queryString token at all. So remove it from both of your inputs. Instead, in your dashboard panel replace $queryString$ with what you were setting it to

index="test" Source="$field$" $trackingparam1$="$trackingval1$"
|table TransactionId Name Source Target Status Details

Now if you set your dropdowns both to "search on change", I think the panel will update as expected.

If the second dropdown is changed, the search should rerun with the update trackingval1 token. If the first dropdown is changed, trackingval1 will be unset, the second dropdown should repopulate, the default choice will be selected, trackingval1 will get set again and the search panel should update accordingly.

View solution in original post

maciep
Champion

If I'm reading this right, you may be able to get away with not using that queryString token at all. So remove it from both of your inputs. Instead, in your dashboard panel replace $queryString$ with what you were setting it to

index="test" Source="$field$" $trackingparam1$="$trackingval1$"
|table TransactionId Name Source Target Status Details

Now if you set your dropdowns both to "search on change", I think the panel will update as expected.

If the second dropdown is changed, the search should rerun with the update trackingval1 token. If the first dropdown is changed, trackingval1 will be unset, the second dropdown should repopulate, the default choice will be selected, trackingval1 will get set again and the search panel should update accordingly.

vravisplunker
Explorer

Thank you maciep,
It worked like a charm.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...