Dashboards & Visualizations

dynamic dropdown field for label and field for label

dwibedi03
Explorer

Hi,

I am implementing dropdown through dynamic options and the search for the dropdown has two fields; index and index_label.

I was hoping to use index to pass in the search and index_label as the label for title. However, somehow when I have field for label as index_label. It doesnt work.

I also tried adding <condition>
<set token="panellabel">$label$</set>
</condition> it doesnt work.

Can someone let me know if I am doing something wrong?

<row>
<panel>
<title>Historical Overview By Day</title>
<input type="dropdown" token="weekday" searchWhenChanged="true">
<label>Select a Weekday:</label>
<choice value="Monday">Monday</choice>
<choice value="Tuesday">Tuesday</choice>
<choice value="Wednesday">Wednesday</choice>
<choice value="Thursday">Thursday</choice>
<choice value="Friday">Friday</choice>
<fieldForLabel>Weekday</fieldForLabel>
<fieldForValue>Weekday</fieldForValue>
<default>Monday</default>
</input>
<input type="dropdown" token="index" searchWhenChanged="true">
<label>Select a Index-</label>
<fieldForLabel>index_label</fieldForLabel>
<fieldForValue>index</fieldForValue>
<search>
<query>| tstats count WHERE index=* BY index | eval index_label = upper(split(index,"_")) | rex mode=sed field=index_label "s/_/ /g"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<change>
<condition>
<set token="panellabel">$label$</set>
</condition>
</change>
</input>
<chart>
<title>Log Volume for $weekday$ - $panellabel$</title>
<search>
<query>| tstats count WHERE index=$index$ BY index _time span=1d
 | trendline sma2(count) AS trend</query>
<earliest>-90d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<row>
<panel>
<title>Historical Overview By Day</title>
<input type="dropdown" token="weekday" searchWhenChanged="true">
<label>Select a Weekday:</label>
<choice value="Monday">Monday</choice>
<choice value="Tuesday">Tuesday</choice>
<choice value="Wednesday">Wednesday</choice>
<choice value="Thursday">Thursday</choice>
<choice value="Friday">Friday</choice>
<fieldForLabel>Weekday</fieldForLabel>
<fieldForValue>Weekday</fieldForValue>
<default>Monday</default>
</input>
<input type="dropdown" token="index" searchWhenChanged="true">
<label>Select a Index-</label>
<fieldForLabel>index_label</fieldForLabel>
<fieldForValue>index</fieldForValue>
<search>
<query>| tstats count WHERE index=* BY index | eval index_label = upper(split(index,"_")) | rex mode=sed field=index_label "s/_/ /g"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<change>
<set token="panellabel">$form.index$</set>
</change>
</input>
<chart>
<title>Log Volume for $weekday$ - $panellabel$</title>
<search>
<query>| tstats count WHERE index=$panellabel$ BY index _time span=1d
 | trendline sma2(count) AS trend</query>
<earliest>-90d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>

<set token="panellabel">$form.index$</set> sets panellabel to the selected value

<query>| tstats count WHERE index=$panellabel$ BY index _time span=1d
| trendline sma2(count) AS trend</query> uses the token value in the query

0 Karma

dwibedi03
Explorer

After implementing this, I am still not able to set different name for the panel title. The search that I am using for the dynamic has two fields index (proxy_logs) and index_label (Proxy Logs). I want to use index in the search to populate the chart and index_label in the panel title so that it looks like Log Volume for Proxy Logs.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<change>
<set token="panellabel">$label$</set>
<set token="panelindex">$value$</set>
</change>
</input>
<chart>
<title>Log Volume for $weekday$ - $panellabel$</title>
<search>
<query>| tstats count WHERE index=$panelindex$ BY index _time span=1d
 | trendline sma2(count) AS trend</query>
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...