Dashboards & Visualizations

splunk framework form dropdown problem

Federica_92
Communicator

Hi all,
I'm trying to make a simple dropdown in splunk framework that visualize all my source.
What I'm suppose to insert in the block content, to visualize the dropdown?
And I would like use the results of the search instead of 1, 2, 3, How I can do this?

{% extends "splunkdj:base_with_app_bar.html" %}
{% load splunkmvc %}

{% block content %}


{% endblock content%}

{% block js %}
    <script>
    var deps = [
            "splunkjs/ready!",
            "splunkjs/mvc/searchmanager",
            "splunkjs/mvc/dropdownview"
        ];

        require(deps, function(mvc) {
            var SearchManager = require("splunkjs/mvc/searchmanager");
        new SearchManager({
                id: "mysearch-log",
                search: "index=waratek | stats dc(source) by source | eval rule=source | fields rule"
            });

    var DropdownView = require("splunkjs/mvc/dropdownview");
        new DropdownView({
            id: "drop-list",
            default: "One",
            el: $("#divToHangOn")
        }).render();


    var choices = [{label: " One", value: "One"},
        {label:" Two", value: "Two"},
        {label:" Three", value: "Three"}];

    //I would like use the results of the search instead of this 3 values
    //like=label:" Two", value: rule[2]
    //like=label:" Three", value: rule[3]


    splunkjs.mvc.Components.getInstance("drop-list").settings.set("choices", choices);

        var sbg = splunkjs.mvc.Components.getInstance("drop-list");
        var sbResult = document.getElementById("example-dropdown-result");
        sbg.on("change", function(){
            sbResult.innerHTML = sbg.val();
        });

//write the drop-list click in a in a file

        });
    </script>
{% endblock js %}

Thank you

Tags (3)
0 Karma

Raghav2384
Motivator
Please take a look at this

 http://dev.splunk.com/view/SP-CAAAEN4  (On the right hand side, you have step by step instructions)

{block managers} will hold the search and {block content} will contain the type of visualization you want for the searches.

Also, are you looking for total # of sources in a index? or count of events per source ?

index=waratek|stats count as Events by source? Hope this helps

Thanks,
Raghav
0 Karma

Federica_92
Communicator

Thank you for your reply, I would like create a dropdown menu to select " rul1 " or "rul2" or "rul3" that are all my source if I search index=waratek.
So yeah: index=waratek | stats dc(source) (And in splunk works perfectly, give me the correct results).

The problem is that If I create this query and next I try to make something like this:
{block content..
{% dropdown id="list" managerid="list-search" %}

and in search, or in the javascript code I add the query:
index=waratek | stats dc(source) by source | fields source

I'll obtain an error like"Duplicate labels causing conflict splunk"

So I'm trying with "var choices = [{label: " One", value: "One"},
{label:" Two", value: "Two"},
{label:" Three", value: "Three"}];"
But I would like use instead of these values (one, two..), the results of my previously query (rul1, rul2..)
And next take this value to create another query.

Please, how I can make this?
Thank you a mil

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Optimize AI at Scale: Must-Attend Observability Sessions at .conf26

conf26   With nearly 70 breakout sessions on the docket, the .conf26 Observability track is designed to help ...

How much can you really learn in 3 minutes?

Observability can certainly be hard to understand – there's a lot of jargon and buzzwords and it seems to ...

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...