Dashboards & Visualizations

how to load interesting fields depending on selected index

saifuddin9122
Path Finder

Hello All

i'm trying to create a dashboard where my first drop down is to select time and second drop down is to select index then depending on these two selected inputs i want to load all the interesting fields associated to the selected index and show them on dashboard so that user can select any field that he require. is it possible to do so? if so can any one guide me how to do it .

Thanks

0 Karma

proylea
Contributor

What you need to do is populate subsequent dropdown menus with the combined result of previous searches run from menu selections.

This should do the job

Hope that helps 🙂

<form>
  <label></label>
  <fieldset submitButton="true">
    <input type="time" token="timeset" searchWhenChanged="true">
      <label>Time</label>
      <default>
        <earliest>*</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="setindex" searchWhenChanged="true">
      <label>Index</label>
      <default>*</default>
      <choice value="*">All</choice>
      <search>
        <query>index=* | dedup index | table index</query>
        <earliest>$timeset.earliest$</earliest>
        <latest>$timeset.latest$</latest>
      </search>
      <fieldForLabel>index</fieldForLabel>
      <fieldForValue>index</fieldForValue>
      <initialValue>*</initialValue>
    </input>
    <input type="dropdown" token="setfield" searchWhenChanged="true">
      <label>Interesting Fields</label>
      <default>*</default>
      <choice value="*">All</choice>
      <search>
        <query>index=$setindex$ | fieldsummary | table field</query>
        <earliest>$timeset.earliest$</earliest>
        <latest>$timeset.latest$</latest>
      </search>
      <fieldForLabel>field</fieldForLabel>
      <fieldForValue>field</fieldForValue>
    </input>
  </fieldset>
</form>
0 Karma

somesoni2
Revered Legend
0 Karma

saifuddin9122
Path Finder

Thanks for response. yeah i did but is there anyway that i can load all the filed names and show them in dropdown

0 Karma

somesoni2
Revered Legend

Yup.. your downdown should search like this (assuming your time dropdown is actually time range picker)

index=$YourIndexDropdownToken$ earliest=$yourTimeToken.earliest$ latest=$yourTimeToken.latest$ | field summary | table field

niketn
Legend

@somesoni2, I think you meant | fieldsummary without space

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...