Dashboards & Visualizations

how to load interesting fields depending on selected index

saifuddin9122
Path Finder

Hello All

i'm trying to create a dashboard where my first drop down is to select time and second drop down is to select index then depending on these two selected inputs i want to load all the interesting fields associated to the selected index and show them on dashboard so that user can select any field that he require. is it possible to do so? if so can any one guide me how to do it .

Thanks

0 Karma

proylea
Contributor

What you need to do is populate subsequent dropdown menus with the combined result of previous searches run from menu selections.

This should do the job

Hope that helps 🙂

<form>
  <label></label>
  <fieldset submitButton="true">
    <input type="time" token="timeset" searchWhenChanged="true">
      <label>Time</label>
      <default>
        <earliest>*</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="setindex" searchWhenChanged="true">
      <label>Index</label>
      <default>*</default>
      <choice value="*">All</choice>
      <search>
        <query>index=* | dedup index | table index</query>
        <earliest>$timeset.earliest$</earliest>
        <latest>$timeset.latest$</latest>
      </search>
      <fieldForLabel>index</fieldForLabel>
      <fieldForValue>index</fieldForValue>
      <initialValue>*</initialValue>
    </input>
    <input type="dropdown" token="setfield" searchWhenChanged="true">
      <label>Interesting Fields</label>
      <default>*</default>
      <choice value="*">All</choice>
      <search>
        <query>index=$setindex$ | fieldsummary | table field</query>
        <earliest>$timeset.earliest$</earliest>
        <latest>$timeset.latest$</latest>
      </search>
      <fieldForLabel>field</fieldForLabel>
      <fieldForValue>field</fieldForValue>
    </input>
  </fieldset>
</form>
0 Karma

somesoni2
Revered Legend
0 Karma

saifuddin9122
Path Finder

Thanks for response. yeah i did but is there anyway that i can load all the filed names and show them in dropdown

0 Karma

somesoni2
Revered Legend

Yup.. your downdown should search like this (assuming your time dropdown is actually time range picker)

index=$YourIndexDropdownToken$ earliest=$yourTimeToken.earliest$ latest=$yourTimeToken.latest$ | field summary | table field

niketn
Legend

@somesoni2, I think you meant | fieldsummary without space

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...