Dashboards & Visualizations

dynamic dropdown field for label and field for label

dwibedi03
Explorer

Hi,

I am implementing dropdown through dynamic options and the search for the dropdown has two fields; index and index_label.

I was hoping to use index to pass in the search and index_label as the label for title. However, somehow when I have field for label as index_label. It doesnt work.

I also tried adding <condition>
<set token="panellabel">$label$</set>
</condition> it doesnt work.

Can someone let me know if I am doing something wrong?

<row>
<panel>
<title>Historical Overview By Day</title>
<input type="dropdown" token="weekday" searchWhenChanged="true">
<label>Select a Weekday:</label>
<choice value="Monday">Monday</choice>
<choice value="Tuesday">Tuesday</choice>
<choice value="Wednesday">Wednesday</choice>
<choice value="Thursday">Thursday</choice>
<choice value="Friday">Friday</choice>
<fieldForLabel>Weekday</fieldForLabel>
<fieldForValue>Weekday</fieldForValue>
<default>Monday</default>
</input>
<input type="dropdown" token="index" searchWhenChanged="true">
<label>Select a Index-</label>
<fieldForLabel>index_label</fieldForLabel>
<fieldForValue>index</fieldForValue>
<search>
<query>| tstats count WHERE index=* BY index | eval index_label = upper(split(index,"_")) | rex mode=sed field=index_label "s/_/ /g"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<change>
<condition>
<set token="panellabel">$label$</set>
</condition>
</change>
</input>
<chart>
<title>Log Volume for $weekday$ - $panellabel$</title>
<search>
<query>| tstats count WHERE index=$index$ BY index _time span=1d
 | trendline sma2(count) AS trend</query>
<earliest>-90d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<row>
<panel>
<title>Historical Overview By Day</title>
<input type="dropdown" token="weekday" searchWhenChanged="true">
<label>Select a Weekday:</label>
<choice value="Monday">Monday</choice>
<choice value="Tuesday">Tuesday</choice>
<choice value="Wednesday">Wednesday</choice>
<choice value="Thursday">Thursday</choice>
<choice value="Friday">Friday</choice>
<fieldForLabel>Weekday</fieldForLabel>
<fieldForValue>Weekday</fieldForValue>
<default>Monday</default>
</input>
<input type="dropdown" token="index" searchWhenChanged="true">
<label>Select a Index-</label>
<fieldForLabel>index_label</fieldForLabel>
<fieldForValue>index</fieldForValue>
<search>
<query>| tstats count WHERE index=* BY index | eval index_label = upper(split(index,"_")) | rex mode=sed field=index_label "s/_/ /g"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<change>
<set token="panellabel">$form.index$</set>
</change>
</input>
<chart>
<title>Log Volume for $weekday$ - $panellabel$</title>
<search>
<query>| tstats count WHERE index=$panellabel$ BY index _time span=1d
 | trendline sma2(count) AS trend</query>
<earliest>-90d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>

<set token="panellabel">$form.index$</set> sets panellabel to the selected value

<query>| tstats count WHERE index=$panellabel$ BY index _time span=1d
| trendline sma2(count) AS trend</query> uses the token value in the query

0 Karma

dwibedi03
Explorer

After implementing this, I am still not able to set different name for the panel title. The search that I am using for the dynamic has two fields index (proxy_logs) and index_label (Proxy Logs). I want to use index in the search to populate the chart and index_label in the panel title so that it looks like Log Volume for Proxy Logs.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<change>
<set token="panellabel">$label$</set>
<set token="panelindex">$value$</set>
</change>
</input>
<chart>
<title>Log Volume for $weekday$ - $panellabel$</title>
<search>
<query>| tstats count WHERE index=$panelindex$ BY index _time span=1d
 | trendline sma2(count) AS trend</query>
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!