changing a parameter in multiple charts for a dashboard

[habisht]

Hi All, I'm trying to create a dashboard with multiple charts in a dashboard. And want to change a single parameter i.e. environment in all the charts with a common drop-down. Is there any way to do this?

[niketn]

@habisht this should be straight-forward depending on the field which corresponds to environment using token through Dropdown. For example if environment is linked to index or sourcetype in your data (or both), then you can create a dropdown following the guideline from Splunk Documentation (https://docs.splunk.com/Documentation/Splunk/latest/Viz/FormEditor#Dropdown_input) or Splunk Dashboard Examples App from Splunkbase.

While the Label in the dropdown will show the Label as selected environment, its Value will be the part of SPL (Splunk Query) that needs to change.

Following is an example of dropdown with token $tokEnvironment$ which sets the corresponding environment filter in the SPL (I have taken index to be different for different environment but same sourcetype).

<input type="dropdown" token="tokEnvironment">
   <label>Select Environment</label>
   <default>index=yourDevIndex sourcetype=yourSourceType</default>
   <choice value="index=yourDevIndex sourcetype=yourSourceType">Development</choice>
   <choice value="index=yourStageIndex sourcetype=yourSourceType">Staging</choice>
   <choice value="index=yourProdIndex sourcetype=yourSourceType">Production</choice>
</input>

Then use $tokEnvironment$ in your SPL query

<search>
    <query> $tokEnvironment$ <yourRemainingQueryGoesHere>
    </query>
</search>