Dashboards & Visualizations

variable field name with variable field value

truckturner
Loves-to-Learn

I am trying to make a drop down dependent on another dropdown. However my field name has a variable in it as well as the field value. 

Example: 

experiments__12345=CONTROL 
experiments__56752=test-1

experiments__12345=control

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@truckturner 

Can you please share more details about your expectations from your given example?

KV 

0 Karma

truckturner
Loves-to-Learn

I have two dropdowns one which lists the name of the experiment in this form : experiment.12345 

I have that dropdown configured and now I need the second one to display the field experiment__12345= values as it's options. 

The problem I can't figure out is how to make the second DD react when the experiment.12345 is selected. 

Does that help? 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@truckturner 

Can you please try this? Just check dropdowns. 

<form>
  <label>Dependent Drop Down</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>field1</label>
      <fieldForLabel>value</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <search>
        <query>| makeresults | eval value="experiment.12345"</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <change>
        <eval token="selected_val">replace(value,"\\.","__")</eval>
      </change>
    </input>
    <input type="dropdown" token="field2">
      <label>field2</label>
      <fieldForLabel>value</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <search>
        <query>| makeresults | eval _raw="value
experiment__12342
experiment__12343
experiment__12345
experiment__12344
experiment__12346
"| multikv forceheader=1
| table value | search value="$selected_val$"</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
</form>

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

The Problem: When Networks and Services Don't Talk Payment systems fail at a retail location. Customers are ...

Print, Leak, Repeat: UEBA Insider Threats You Can't Ignore

Are you ready to uncover the threats hiding in plain sight? Join us for "Print, Leak, Repeat: UEBA Insider ...

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...