Dashboards & Visualizations

dynamic dropdown field for label and field for label

dwibedi03
Explorer

Hi,

I am implementing dropdown through dynamic options and the search for the dropdown has two fields; index and index_label.

I was hoping to use index to pass in the search and index_label as the label for title. However, somehow when I have field for label as index_label. It doesnt work.

I also tried adding <condition>
<set token="panellabel">$label$</set>
</condition> it doesnt work.

Can someone let me know if I am doing something wrong?

<row>
<panel>
<title>Historical Overview By Day</title>
<input type="dropdown" token="weekday" searchWhenChanged="true">
<label>Select a Weekday:</label>
<choice value="Monday">Monday</choice>
<choice value="Tuesday">Tuesday</choice>
<choice value="Wednesday">Wednesday</choice>
<choice value="Thursday">Thursday</choice>
<choice value="Friday">Friday</choice>
<fieldForLabel>Weekday</fieldForLabel>
<fieldForValue>Weekday</fieldForValue>
<default>Monday</default>
</input>
<input type="dropdown" token="index" searchWhenChanged="true">
<label>Select a Index-</label>
<fieldForLabel>index_label</fieldForLabel>
<fieldForValue>index</fieldForValue>
<search>
<query>| tstats count WHERE index=* BY index | eval index_label = upper(split(index,"_")) | rex mode=sed field=index_label "s/_/ /g"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<change>
<condition>
<set token="panellabel">$label$</set>
</condition>
</change>
</input>
<chart>
<title>Log Volume for $weekday$ - $panellabel$</title>
<search>
<query>| tstats count WHERE index=$index$ BY index _time span=1d
 | trendline sma2(count) AS trend</query>
<earliest>-90d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<row>
<panel>
<title>Historical Overview By Day</title>
<input type="dropdown" token="weekday" searchWhenChanged="true">
<label>Select a Weekday:</label>
<choice value="Monday">Monday</choice>
<choice value="Tuesday">Tuesday</choice>
<choice value="Wednesday">Wednesday</choice>
<choice value="Thursday">Thursday</choice>
<choice value="Friday">Friday</choice>
<fieldForLabel>Weekday</fieldForLabel>
<fieldForValue>Weekday</fieldForValue>
<default>Monday</default>
</input>
<input type="dropdown" token="index" searchWhenChanged="true">
<label>Select a Index-</label>
<fieldForLabel>index_label</fieldForLabel>
<fieldForValue>index</fieldForValue>
<search>
<query>| tstats count WHERE index=* BY index | eval index_label = upper(split(index,"_")) | rex mode=sed field=index_label "s/_/ /g"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<change>
<set token="panellabel">$form.index$</set>
</change>
</input>
<chart>
<title>Log Volume for $weekday$ - $panellabel$</title>
<search>
<query>| tstats count WHERE index=$panellabel$ BY index _time span=1d
 | trendline sma2(count) AS trend</query>
<earliest>-90d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>

<set token="panellabel">$form.index$</set> sets panellabel to the selected value

<query>| tstats count WHERE index=$panellabel$ BY index _time span=1d
| trendline sma2(count) AS trend</query> uses the token value in the query

0 Karma

dwibedi03
Explorer

After implementing this, I am still not able to set different name for the panel title. The search that I am using for the dynamic has two fields index (proxy_logs) and index_label (Proxy Logs). I want to use index in the search to populate the chart and index_label in the panel title so that it looks like Log Volume for Proxy Logs.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<change>
<set token="panellabel">$label$</set>
<set token="panelindex">$value$</set>
</change>
</input>
<chart>
<title>Log Volume for $weekday$ - $panellabel$</title>
<search>
<query>| tstats count WHERE index=$panelindex$ BY index _time span=1d
 | trendline sma2(count) AS trend</query>
0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...