Dashboards & Visualizations

variable field name with variable field value

truckturner
Loves-to-Learn

I am trying to make a drop down dependent on another dropdown. However my field name has a variable in it as well as the field value. 

Example: 

experiments__12345=CONTROL 
experiments__56752=test-1

experiments__12345=control

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@truckturner 

Can you please share more details about your expectations from your given example?

KV 

0 Karma

truckturner
Loves-to-Learn

I have two dropdowns one which lists the name of the experiment in this form : experiment.12345 

I have that dropdown configured and now I need the second one to display the field experiment__12345= values as it's options. 

The problem I can't figure out is how to make the second DD react when the experiment.12345 is selected. 

Does that help? 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@truckturner 

Can you please try this? Just check dropdowns. 

<form>
  <label>Dependent Drop Down</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>field1</label>
      <fieldForLabel>value</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <search>
        <query>| makeresults | eval value="experiment.12345"</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <change>
        <eval token="selected_val">replace(value,"\\.","__")</eval>
      </change>
    </input>
    <input type="dropdown" token="field2">
      <label>field2</label>
      <fieldForLabel>value</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <search>
        <query>| makeresults | eval _raw="value
experiment__12342
experiment__12343
experiment__12345
experiment__12344
experiment__12346
"| multikv forceheader=1
| table value | search value="$selected_val$"</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
</form>

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

The Trust Gap: Why a Data Foundation is Fundamental to an Agentic Enterprise

The Trust Gap: Why a data foundation is fundamental to an  Agentic Enterprise.   Agentic AI is transforming ...

Data Management Digest – September 2026

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of ...