Dashboards & Visualizations

how to fill new values in 2nd dropdown by selecting a value in 1st dropdown after clearing previous values in 2nd dropdown

sawgata12345
Path Finder

Hi,
I have two dropdown D1 and D2.

on selecting a value in D1 certain values from event gets filled in D2. Now if i change the value in D1 new values are getting filled in D2 along with the previous values.
How do I clear the D2 before filling new values?

I tried tag also but still not working
[[


initiator_id
initiator_id

index="demo1" | dedup initiator_id | table initiator_id




target_id
target_id




index="demo1" initiator_id=$inits$ | dedup target_id | table target_id

]]

Tags (2)
0 Karma
1 Solution

Elsurion
Communicator

Hi there

Your approach is not too bad, but you have to take the token for the seachh. I assume that you set that in your first dropdown, since it's not visible here

An example, how i have to this multiple times. One with four dropdowns but showing only the first two.

    <input type="dropdown" token="myindex" searchWhenChanged="true">
      <label>Application Log</label>
      <fieldForLabel>index</fieldForLabel>
      <fieldForValue>index</fieldForValue>
      <search>
        <query>| eventcount summarize=false index=log_* 
| dedup index 
| fields index</query>
        <earliest>$field1.earliest$</earliest>
        <latest>$field1.latest$</latest>
      </search>
      <change>
        <unset token="cust"></unset>
        <unset token="mysourcetype"></unset>
        <unset token="mysource"></unset>
        <unset token="myhost"></unset>
        <unset token="form.cust"></unset>
        <unset token="form.mysource"></unset>
        <unset token="form.mysourcetype"></unset>
        <unset token="form.myhost"></unset>
      </change>
    </input>
    <input type="dropdown" token="mysourcetype" searchWhenChanged="true">
      <label>Sourcetype</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=$myindex$
| fields sourcetype
| dedup sourcetype
| table sourcetype</query>
        <earliest>$field1.earliest$</earliest>
        <latest>$field1.latest$</latest>
      </search>
      <change>
        <unset token="cust"></unset>
        <unset token="mysource"></unset>
        <unset token="myhost"></unset>
        <unset token="form.cust"></unset>
        <unset token="form.mysource"></unset>
        <unset token="form.myhost"></unset>
      </change>
    </input>

View solution in original post

0 Karma

Elsurion
Communicator

Hi there

Your approach is not too bad, but you have to take the token for the seachh. I assume that you set that in your first dropdown, since it's not visible here

An example, how i have to this multiple times. One with four dropdowns but showing only the first two.

    <input type="dropdown" token="myindex" searchWhenChanged="true">
      <label>Application Log</label>
      <fieldForLabel>index</fieldForLabel>
      <fieldForValue>index</fieldForValue>
      <search>
        <query>| eventcount summarize=false index=log_* 
| dedup index 
| fields index</query>
        <earliest>$field1.earliest$</earliest>
        <latest>$field1.latest$</latest>
      </search>
      <change>
        <unset token="cust"></unset>
        <unset token="mysourcetype"></unset>
        <unset token="mysource"></unset>
        <unset token="myhost"></unset>
        <unset token="form.cust"></unset>
        <unset token="form.mysource"></unset>
        <unset token="form.mysourcetype"></unset>
        <unset token="form.myhost"></unset>
      </change>
    </input>
    <input type="dropdown" token="mysourcetype" searchWhenChanged="true">
      <label>Sourcetype</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=$myindex$
| fields sourcetype
| dedup sourcetype
| table sourcetype</query>
        <earliest>$field1.earliest$</earliest>
        <latest>$field1.latest$</latest>
      </search>
      <change>
        <unset token="cust"></unset>
        <unset token="mysource"></unset>
        <unset token="myhost"></unset>
        <unset token="form.cust"></unset>
        <unset token="form.mysource"></unset>
        <unset token="form.myhost"></unset>
      </change>
    </input>
0 Karma

sawgata12345
Path Finder
  <label>Initiator</label>
  <fieldForLabel>initiator_id</fieldForLabel>
  <fieldForValue>initiator_id</fieldForValue>
  <search>
    <query>index="demo1" | dedup initiator_id | table initiator_id</query>
  </search>
</input>
<input type="dropdown" token="targetsel" searchWhenChanged="true">
  <label>Target</label>
  <fieldForLabel>target_id</fieldForLabel>
  <fieldForValue>target_id</fieldForValue>
  <change>
     <unset token="form.dropdown"></unset>
  </change>
  <search>
    <query>index="demo1" initiator_id=$inits$ | dedup target_id | table target_id</query>
  </search>
</input>
0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...