Dashboards & Visualizations

unset tokens dynamically in dropdown's

Explorer

Hello Friends,

Can you please help me how to unset the tokens based on the dropdowns values. Here is the example

When i select first dropdown(lets say "TRACTOR" FROM "VEHICLE_NAME", the values are coming as expected, When i select the other value from first dropdown(lets say "ZEEP", I am not able to see the "ZEEP" VALUES in below table. Please help me with other 3 dropdowns as well (COMPANY_NAME,MODEL,YEAR).Please find the screenshot and code attached . Thanks in Advance!

<input type="dropdown" token="VEHICLE_NAME" searchWhenChanged="false">
  <label>Select Vehicle Type</label>
  <default>TRACTOR</default>
  <fieldForLabel>VEHICLE_NAME</fieldForLabel>
  <fieldForValue>VEHICLE_NAME</fieldForValue>
  <search>
    <query>index="idx_dropdown" | fields VEHICLE_NAME | dedup VEHICLE_NAME | table VEHICLE_NAME</query>
    <earliest>0</earliest>
    <latest></latest>
  </search>
</input>
<input type="dropdown" token="COMPANY_NAME" searchWhenChanged="true">
  <label>Select Company Name</label>
  <choice value="*">All</choice>
  <default>*</default>
  <initialValue>*</initialValue>
  <fieldForLabel>COMPANY_NAME</fieldForLabel>
  <fieldForValue>COMPANY_NAME</fieldForValue>
  <search>
    <query>index="idx_dropdown" VEHICLE_NAME="$VEHICLE_NAME$" | fields COMPANY_NAME | dedup COMPANY_NAME | table  COMPANY_NAME</query>
    <earliest>0</earliest>
    <latest></latest>
  </search>
</input>
<input type="dropdown" token="MODEL" searchWhenChanged="true">
  <label>Select Model</label>
  <choice value="*">All</choice>
  <default>*</default>
  <initialValue>*</initialValue>
  <fieldForLabel>MODEL</fieldForLabel>
  <fieldForValue>MODEL</fieldForValue>
  <search>
    <query>index="idx_dropdown"  COMPANY_NAME="$COMPANY_NAME$" | fields MODEL | dedup MODEL | table MODEL</query>
    <earliest>0</earliest>
    <latest></latest>
  </search>
</input>
<input type="dropdown" token="YEAR" searchWhenChanged="true">
  <label>Select Year</label>
  <choice value="*">All</choice>
  <default>*</default>
  <initialValue>*</initialValue>
  <fieldForLabel>YEAR</fieldForLabel>
  <fieldForValue>YEAR</fieldForValue>
  <search>
    <query>index="idx_dropdown" MODEL="$MODEL$" | fields YEAR | dedup YEAR | table YEAR</query>
    <earliest>0</earliest>
    <latest></latest>
  </search>
</input>


<panel>
  <title>Dynamic Data selection</title>
  <table>
    <search>
      <query>index="idx_dropdown" "$VEHICLE_NAME$" "$COMPANY_NAME$" "$MODEL$" "$YEAR$" | table VEHICLE_NAME,COMPANY_NAME,MODEL,YEAR</query>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="count">20</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
    <option name="percentagesRow">false</option>
    <option name="rowNumbers">false</option>
    <option name="totalsRow">false</option>
    <option name="wrap">true</option>
  </table>
</panel>
Tags (2)
0 Karma

Explorer

I am looking something like this for un setting the tokens.

Select Vehicle Type
TRACTOR
VEHICLE_NAME
VEHICLE_NAME

 <query>index="idx_dropdown" | fields VEHICLE_NAME | dedup VEHICLE_NAME | table VEHICLE_NAME</query>







 <earliest>0</earliest>
 <latest></latest>

Select Vehicle Type
TRACTOR
VEHICLE_NAME
VEHICLE_NAME

 <query>index="idx_dropdown" | fields VEHICLE_NAME | dedup VEHICLE_NAME | table VEHICLE_NAME</query>







 <earliest>0</earliest>
 <latest></latest>
0 Karma

Explorer

I have changed to true from false. I need to unset the tokens like . So that when ever i selected the dropdowns, the respective filters will be unset. Please help. By this the table data will be displayed.

Select Vehicle Type
TRACTOR
VEHICLE_NAME
VEHICLE_NAME

 <query>index="idx_dropdown" | fields VEHICLE_NAME | dedup VEHICLE_NAME | table VEHICLE_NAME</query>





 <earliest>0</earliest>
 <latest></latest>

Select Company Name
All
*
*
COMPANY_NAME
COMPANY_NAME

 <query>index="idx_dropdown" VEHICLE_NAME="$VEHICLE_NAME$" | fields COMPANY_NAME | dedup COMPANY_NAME | table  COMPANY_NAME</query>
 <earliest>0</earliest>
 <latest></latest>
0 Karma

Explorer
<input type="dropdown" token="VEHICLE_NAME" searchWhenChanged="false">
   <label>Select Vehicle Type</label>
   <default>TRACTOR</default>
   <fieldForLabel>VEHICLE_NAME</fieldForLabel>
   <fieldForValue>VEHICLE_NAME</fieldForValue>
   <search>
     <query>index="idx_dropdown" | fields VEHICLE_NAME | dedup VEHICLE_NAME | table VEHICLE_NAME</query>
<change>
<condition label="*">
<unset token="COMPANY_NAME">
<unset token="MODEL">
<unset token="YEAR">
</condition>
</change>
     <earliest>0</earliest>
     <latest></latest>
   </search>
 </input>
0 Karma

SplunkTrust
SplunkTrust

@splunklakshman.... Change searchWhenChanged to true

<input type="dropdown" token="VEHICLE_NAME" searchWhenChanged="false">
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

SplunkTrust
SplunkTrust

@splunklakshman... Please accept if this answer resolved your issue.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Motivator

What about something like this ?

<condition field="Site ID - Click for Detail">
            <set token="tableduration">$click.value2$</set>
          </condition>
          <condition field="*">
            <unset token="tableduration"></unset>
          </condition>
0 Karma

SplunkTrust
SplunkTrust

What happens if you remove the " around the tokens? Eq that the search looks like :

 index="idx_dropdown" VEHICLE_NAME=$VEHICLE_NAME$ COMPANY_NAME=$COMPANY_NAME$ MODEL=$MODEL$ YEAR=$YEAR$
0 Karma

SplunkTrust
SplunkTrust

@splunklakshman... also request you to kindly Accept the answers to the previous questions that you have posted recently around issues related with the dashboard you are working on.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!