Getting Data In

How can I add a UI element in a dashboard to select the source?

czervos
Explorer

I have created some dashboard that I use to expedite debugging of certain issues with one of our applications. The issue I am having and I'd like to improve upon is that currently the source files are hardcoded into the searches of the dashboards. I know I can do a global search and replace in the XML to get it to look at other source files but this is not very user friendly if I want to share this dashboard/tool with others. Is there a way to add a UI element to do this much like the time - drop down in dashboards & apps?

I tried to do this manually and managed to create the UI element. However I can't get the source = $newsource to be replaced in the multiple searches that create the views of the dashboard.

TIA

Tags (2)
0 Karma
1 Solution

MuS
Legend

Hi czervos,

in addition to @somesoni2 answer, take a look at this nice example from the docs. If you follow this, you should be able to get it working.

cheers, MuS

View solution in original post

0 Karma

MuS
Legend

Hi czervos,

in addition to @somesoni2 answer, take a look at this nice example from the docs. If you follow this, you should be able to get it working.

cheers, MuS

0 Karma

somesoni2
Revered Legend

You can create a dropdown to hold the source data (use |metadata type=sources index=main | table source) and then use the dropdown token in your search.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...