Dashboards & Visualizations
Highlighted

how to load interesting fields depending on selected index

Path Finder

Hello All

i'm trying to create a dashboard where my first drop down is to select time and second drop down is to select index then depending on these two selected inputs i want to load all the interesting fields associated to the selected index and show them on dashboard so that user can select any field that he require. is it possible to do so? if so can any one guide me how to do it .

Thanks

0 Karma
Highlighted

Re: how to load interesting fields depending on selected index

SplunkTrust
SplunkTrust
0 Karma
Highlighted

Re: how to load interesting fields depending on selected index

Path Finder

Thanks for response. yeah i did but is there anyway that i can load all the filed names and show them in dropdown

0 Karma
Highlighted

Re: how to load interesting fields depending on selected index

SplunkTrust
SplunkTrust

Yup.. your downdown should search like this (assuming your time dropdown is actually time range picker)

index=$YourIndexDropdownToken$ earliest=$yourTimeToken.earliest$ latest=$yourTimeToken.latest$ | field summary | table field
Highlighted

Re: how to load interesting fields depending on selected index

Legend

@somesoni2, I think you meant | fieldsummary without space




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: how to load interesting fields depending on selected index

Contributor

What you need to do is populate subsequent dropdown menus with the combined result of previous searches run from menu selections.

This should do the job

Hope that helps 🙂

<form>
  <label></label>
  <fieldset submitButton="true">
    <input type="time" token="timeset" searchWhenChanged="true">
      <label>Time</label>
      <default>
        <earliest>*</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="setindex" searchWhenChanged="true">
      <label>Index</label>
      <default>*</default>
      <choice value="*">All</choice>
      <search>
        <query>index=* | dedup index | table index</query>
        <earliest>$timeset.earliest$</earliest>
        <latest>$timeset.latest$</latest>
      </search>
      <fieldForLabel>index</fieldForLabel>
      <fieldForValue>index</fieldForValue>
      <initialValue>*</initialValue>
    </input>
    <input type="dropdown" token="setfield" searchWhenChanged="true">
      <label>Interesting Fields</label>
      <default>*</default>
      <choice value="*">All</choice>
      <search>
        <query>index=$setindex$ | fieldsummary | table field</query>
        <earliest>$timeset.earliest$</earliest>
        <latest>$timeset.latest$</latest>
      </search>
      <fieldForLabel>field</fieldForLabel>
      <fieldForValue>field</fieldForValue>
    </input>
  </fieldset>
</form>
0 Karma