Dashboards & Visualizations

filter based on dropdown with condition

prakashmca05
Explorer

Hi,

Could someone help on the below requirement.

I have the index as sampleindex and which returns the one of the output called environment_name as
app1_dev,
app1_tst,
app1_prd,
app2_dev,
app2_tst,
app2_prd,
app2,dev,
app3_tst,
app3_prd.
along with few more outputs, i have to bring the timechart with environment_name and cost on given duration.

Here I am not interested on all environment, for example i need to get the result only on app1_dev, app2_dev and we don't want to show app3_dev when i am selecting the Environment name as "dev". Same applies for all environment.

And the above given environment combination is just an sample, i have around 10+ environment(dev, int, tst, prd, etc...) with combination of 10 application (app1, app2, app3, etc..,)

I have to use Dropdown as Input field and choice as , to group all the environment type as below.

    <label>Environment</label>
    <choice value="*dev">dev</choice>
    <choice value="*tst">tst</choice>
    <choice value="*prd">prd</choice>
    <default>*prd</default>
  </input>

When i select the value as "dev", the chart should show the output as app1_dev, app2_dev and app2_dev on chart . Could someone help on how to query this. I have tried using case statement, but which returns as sum based on environment namings what i selecting from dropdown..

eval namespace=case(match(environment_name,"app1-dev"),"dev", match(environment_name,"app2-dev"),"dev", match(environment_name,"app3-dev"),"dev")

Re phrased the question again.

Labels (2)
0 Karma

jpolvino
Builder

If your searches are lightweight, you could potentially run all 3 searches and hide/show panels depending on the dropdown value selected. This works well if you have static index and environment_names, which looks to be true in your case. It also renders very fast when you switch the drop down selection.

Here is one way to do it, which can be pasted in as dashboard source XML. It has dummy searches to illustrate different results.

<form>
  <label>3 env demo</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="tokEnv">
      <label>Environment</label>
      <choice value="dev">dev</choice>
      <choice value="tst">tst</choice>
      <choice value="prd">prd</choice>
      <default>dev</default>
      <initialValue>dev</initialValue>
      <change>
        <condition label="dev">
          <set token="dev">true</set>
          <unset token="tst"></unset>
          <unset token="prd"></unset>
        </condition>
        <condition label="tst">
          <unset token="dev"></unset>
          <set token="tst">true</set>
          <unset token="prd"></unset>
        </condition>
        <condition label="prd">
          <unset token="dev"></unset>
          <unset token="tst"></unset>
          <set token="prd">true</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$dev$">
      <table>
        <title>dev panel</title>
        <search>
          <query>| makeresults count=5 | eval x=1 | accum x | autoregress x p=1-4</query>
          <earliest>-10s@s</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel depends="$tst$">
      <table>
        <title>tst panel</title>
        <search>
          <query>| makeresults | eval timestamp=strftime(_time,"%Y-%m-%d %H:%M:%S")</query>
          <earliest>-1s@s</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel depends="$prd$">
      <table>
        <title>prd panel</title>
        <search>
          <query>| makeresults count=3 | eval x=5 | accum x | autoregress x p=1-2</query>
          <earliest>-1s@s</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

prakashmca05
Explorer

Thanks for your Input.

In the example, i have provided just 3 environment name for example. Actually i have around 10+ of environments. Do we have any alternative way rather using the panel for each environment ?

However i will be trying this solution as well to see how this works.

0 Karma

prakashmca05
Explorer

I have updated the question again with clear requirement.

0 Karma
Get Updates on the Splunk Community!

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Automatic Discovery Part 2: Setup and Best Practices

In Part 1 of this series, we covered what Automatic Discovery is and why it’s critical for observability at ...