Dashboards & Visualizations

how to create multiple independent dropdown in a dashboard??

sayanidasgupta
Explorer

how to add three different dropdown in a dashboard, the dashboard values are independent means suppose I select one value in dropdown1 for that values in dropdown2 or 3 will not change, similarly if select any value from dropdown2 values of dropdown1 and 3 will not change, and among them one should be a time range picker.

E.G - I want the data of all vehicles (maruti, auto, bus, train, metro, ALL - values of DROPDOWN 1) traffic for last 7 days (default splunk time range picker - DROPDOWN 3) in a particular time span (5 minutes, 30 minutes, 1 hour etc. - values of DROPDOWN 2)

means I need search report for particular services for a particular time period on a specific span - e.g in last 7 days in a span of 30 minutes how much traffic came for one mobile network.

Please help me out

Tags (1)
0 Karma

niketn
Legend

@sayanidasgupta, please try the following run anywhere example based on information provided in the question. It uses a Submit button to push the values of Dropdown Selections as tokens to the Panel with search.

<form>
  <label>Independent Dropdown for Search</label>
  <fieldset submitButton="true">
    <input type="dropdown" token="tokVehicle" searchWhenChanged="false">
      <label>Select Vehicle</label>
      <choice value="*">All</choice>
      <fieldForLabel>Vehicle</fieldForLabel>
      <fieldForValue>Vehicle</fieldForValue>
      <search>
        <query>|  makeresults
|  eval Vehicle="maruti,auto,bus,train,metro"
|  makemv Vehicle delim=","
|  mvexpand Vehicle
|  dedup Vehicle
|  sort Vehicle
|  table Vehicle</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <default>*</default>
    </input>
    <input type="time" token="tokTime" searchWhenChanged="false">
      <label>Select Time</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="tokSpan" searchWhenChanged="false">
      <label>Select Span</label>
      <choice value="5min">5 Min</choice>
      <choice value="30m">30 Min</choice>
      <choice value="1h">Hourly</choice>
      <choice value="1d">Daily</choice>
      <default>1d</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Search Filter</title>
        <search>
          <query>|  gentimes start=-11 span=1d 
|  eval _time=starttime
|  table _time
|  appendcols
    [|  makeresults
    |  fields - _time
|  eval Vehicle="maruti,auto,bus,train,metro,maruti,auto,bus,bus,metro,train" 
|  makemv Vehicle delim=","
|  mvexpand Vehicle]
|  appendcols
    [|  makeresults
    |  fields - _time
|  eval count="3,4,10,30,20,2,4,10,12,21,15" 
|  makemv count delim=","
|  mvexpand count]
|  search Vehicle="$tokVehicle$"
|  timechart span="$tokSpan$" sum(count) as Total by Vehicle</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.chart.nullValueMode">zero</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>

Kindly change as per your needs and use your queries instead of Run anywhere searches used in the example. Try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...