dashboard panel not getting updated based on the selected dropdown input

[shari]

hi team,

i have created a lookup table and i have a dashboard which makes use of the values the lookup table. The dashboard has a dropdown which has values from one of the columns in the lookup table. I want to update the dashboard panel based on the selected drop down value and show a trend graph plotting data from another column of the lookup table. Can someone help in building a query for the same.

shari

<form>
<label>Transaction Trend</label>
<description>Shows the response time trend graph of a particular transaction</description>
<fieldset submitButton="true" autoRun="false">
<input type="dropdown" searchWhenChanged="true" token="transaction">
<label>Transaction</label>
<fieldForLabel>Transaction Name</fieldForLabel>
<fieldForValue>Transaction Name</fieldForValue>
<search>
<query>| inputlookup test.csv | stats count by "Transaction Name"</query>
</search>
</input>
</fieldset>
<row>
<panel>
<chart>
<title>90% response time trend</title>
<search>
<query>| inputlookup test.csv |table $transaction$, 90%</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
</form>

[gcusello · Accepted solution]

Hi @shari,

Let me understand: you want to filter the results of the search (| inputlookup test.csv |table $transaction$, 90%) with the results of the dropdown, is this correct?

at first, if possible, try to avoid fields with spaces "Transaction Name", insert e.g. an underscore in the middle Transaction_Name and rename it at the end to display the field and names with special chars like "%".

Then, the search isn't correct, try something like this:

| inputlookup test.csv WHERE Transaction_Name="$transaction$"
| table Transaction_Name 90perc
| rename Transaction_Name AS "Transaction Name" 90perc AS "90%"

Ciao.

Giuseppe

[gcusello]

Hi @shari,

good splunkg!

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉