Dashboards & Visualizations

filter based on dropdown with condition

prakashmca05
Explorer

Hi,

Could someone help on the below requirement.

I have the index as sampleindex and which returns the one of the output called environment_name as
app1_dev,
app1_tst,
app1_prd,
app2_dev,
app2_tst,
app2_prd,
app2,dev,
app3_tst,
app3_prd.
along with few more outputs, i have to bring the timechart with environment_name and cost on given duration.

Here I am not interested on all environment, for example i need to get the result only on app1_dev, app2_dev and we don't want to show app3_dev when i am selecting the Environment name as "dev". Same applies for all environment.

And the above given environment combination is just an sample, i have around 10+ environment(dev, int, tst, prd, etc...) with combination of 10 application (app1, app2, app3, etc..,)

I have to use Dropdown as Input field and choice as , to group all the environment type as below.

    <label>Environment</label>
    <choice value="*dev">dev</choice>
    <choice value="*tst">tst</choice>
    <choice value="*prd">prd</choice>
    <default>*prd</default>
  </input>

When i select the value as "dev", the chart should show the output as app1_dev, app2_dev and app2_dev on chart . Could someone help on how to query this. I have tried using case statement, but which returns as sum based on environment namings what i selecting from dropdown..

eval namespace=case(match(environment_name,"app1-dev"),"dev", match(environment_name,"app2-dev"),"dev", match(environment_name,"app3-dev"),"dev")

Re phrased the question again.

Labels (2)
0 Karma

jpolvino
Builder

If your searches are lightweight, you could potentially run all 3 searches and hide/show panels depending on the dropdown value selected. This works well if you have static index and environment_names, which looks to be true in your case. It also renders very fast when you switch the drop down selection.

Here is one way to do it, which can be pasted in as dashboard source XML. It has dummy searches to illustrate different results.

<form>
  <label>3 env demo</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="tokEnv">
      <label>Environment</label>
      <choice value="dev">dev</choice>
      <choice value="tst">tst</choice>
      <choice value="prd">prd</choice>
      <default>dev</default>
      <initialValue>dev</initialValue>
      <change>
        <condition label="dev">
          <set token="dev">true</set>
          <unset token="tst"></unset>
          <unset token="prd"></unset>
        </condition>
        <condition label="tst">
          <unset token="dev"></unset>
          <set token="tst">true</set>
          <unset token="prd"></unset>
        </condition>
        <condition label="prd">
          <unset token="dev"></unset>
          <unset token="tst"></unset>
          <set token="prd">true</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$dev$">
      <table>
        <title>dev panel</title>
        <search>
          <query>| makeresults count=5 | eval x=1 | accum x | autoregress x p=1-4</query>
          <earliest>-10s@s</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel depends="$tst$">
      <table>
        <title>tst panel</title>
        <search>
          <query>| makeresults | eval timestamp=strftime(_time,"%Y-%m-%d %H:%M:%S")</query>
          <earliest>-1s@s</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel depends="$prd$">
      <table>
        <title>prd panel</title>
        <search>
          <query>| makeresults count=3 | eval x=5 | accum x | autoregress x p=1-2</query>
          <earliest>-1s@s</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

prakashmca05
Explorer

Thanks for your Input.

In the example, i have provided just 3 environment name for example. Actually i have around 10+ of environments. Do we have any alternative way rather using the panel for each environment ?

However i will be trying this solution as well to see how this works.

0 Karma

prakashmca05
Explorer

I have updated the question again with clear requirement.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...