Dashboards & Visualizations

how to create multiple independent dropdown in a dashboard??

sayanidasgupta
Explorer

how to add three different dropdown in a dashboard, the dashboard values are independent means suppose I select one value in dropdown1 for that values in dropdown2 or 3 will not change, similarly if select any value from dropdown2 values of dropdown1 and 3 will not change, and among them one should be a time range picker.

E.G - I want the data of all vehicles (maruti, auto, bus, train, metro, ALL - values of DROPDOWN 1) traffic for last 7 days (default splunk time range picker - DROPDOWN 3) in a particular time span (5 minutes, 30 minutes, 1 hour etc. - values of DROPDOWN 2)

means I need search report for particular services for a particular time period on a specific span - e.g in last 7 days in a span of 30 minutes how much traffic came for one mobile network.

Please help me out

Tags (1)
0 Karma

niketn
Legend

@sayanidasgupta, please try the following run anywhere example based on information provided in the question. It uses a Submit button to push the values of Dropdown Selections as tokens to the Panel with search.

<form>
  <label>Independent Dropdown for Search</label>
  <fieldset submitButton="true">
    <input type="dropdown" token="tokVehicle" searchWhenChanged="false">
      <label>Select Vehicle</label>
      <choice value="*">All</choice>
      <fieldForLabel>Vehicle</fieldForLabel>
      <fieldForValue>Vehicle</fieldForValue>
      <search>
        <query>|  makeresults
|  eval Vehicle="maruti,auto,bus,train,metro"
|  makemv Vehicle delim=","
|  mvexpand Vehicle
|  dedup Vehicle
|  sort Vehicle
|  table Vehicle</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <default>*</default>
    </input>
    <input type="time" token="tokTime" searchWhenChanged="false">
      <label>Select Time</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="tokSpan" searchWhenChanged="false">
      <label>Select Span</label>
      <choice value="5min">5 Min</choice>
      <choice value="30m">30 Min</choice>
      <choice value="1h">Hourly</choice>
      <choice value="1d">Daily</choice>
      <default>1d</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Search Filter</title>
        <search>
          <query>|  gentimes start=-11 span=1d 
|  eval _time=starttime
|  table _time
|  appendcols
    [|  makeresults
    |  fields - _time
|  eval Vehicle="maruti,auto,bus,train,metro,maruti,auto,bus,bus,metro,train" 
|  makemv Vehicle delim=","
|  mvexpand Vehicle]
|  appendcols
    [|  makeresults
    |  fields - _time
|  eval count="3,4,10,30,20,2,4,10,12,21,15" 
|  makemv count delim=","
|  mvexpand count]
|  search Vehicle="$tokVehicle$"
|  timechart span="$tokSpan$" sum(count) as Total by Vehicle</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.chart.nullValueMode">zero</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>

Kindly change as per your needs and use your queries instead of Run anywhere searches used in the example. Try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...