how to load interesting fields depending on selected index

[saifuddin9122]

Hello All

i'm trying to create a dashboard where my first drop down is to select time and second drop down is to select index then depending on these two selected inputs i want to load all the interesting fields associated to the selected index and show them on dashboard so that user can select any field that he require. is it possible to do so? if so can any one guide me how to do it .

Thanks

[proylea]

What you need to do is populate subsequent dropdown menus with the combined result of previous searches run from menu selections.

This should do the job

Hope that helps 🙂

<form>
  <label></label>
  <fieldset submitButton="true">
    <input type="time" token="timeset" searchWhenChanged="true">
      <label>Time</label>
      <default>
        <earliest>*</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="setindex" searchWhenChanged="true">
      <label>Index</label>
      <default>*</default>
      <choice value="*">All</choice>
      <search>
        <query>index=* | dedup index | table index</query>
        <earliest>$timeset.earliest$</earliest>
        <latest>$timeset.latest$</latest>
      </search>
      <fieldForLabel>index</fieldForLabel>
      <fieldForValue>index</fieldForValue>
      <initialValue>*</initialValue>
    </input>
    <input type="dropdown" token="setfield" searchWhenChanged="true">
      <label>Interesting Fields</label>
      <default>*</default>
      <choice value="*">All</choice>
      <search>
        <query>index=$setindex$ | fieldsummary | table field</query>
        <earliest>$timeset.earliest$</earliest>
        <latest>$timeset.latest$</latest>
      </search>
      <fieldForLabel>field</fieldForLabel>
      <fieldForValue>field</fieldForValue>
    </input>
  </fieldset>
</form>

[somesoni2]

Have a look at fieldsummary command. https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/Fieldsummary

[saifuddin9122]

Thanks for response. yeah i did but is there anyway that i can load all the filed names and show them in dropdown

[somesoni2]

Yup.. your downdown should search like this (assuming your time dropdown is actually time range picker)

index=$YourIndexDropdownToken$ earliest=$yourTimeToken.earliest$ latest=$yourTimeToken.latest$ | field summary | table field

[niketn]

@somesoni2, I think you meant | fieldsummary without space