Getting Data In

How to Create Dynamic Dropdown Inputs at Search Results within a Form (Version 6.3.3)

_gkollias
Builder

Hi,

I’m looking for a way to add dropdown inputs to the search results of a form.

I’m looking for something where the inputs are based on the initial selection from the form (so there are 6 options to choose, and each option displays different field values).

Here is a small sample of the current form:

<form>
  <searchTemplate>
    <![CDATA[ `$tkn_search$` $tkn$ $tkn$ $tkn$ $tkn$ $tkn$ $tkn$ $tkn$
     | `$tkn_transaction_search$`]]>
  </searchTemplate>
  <fieldset autoRun="false" submitButton="true">
    <input type="dropdown" searchWhenChanged="false" token="tkn_search">
      <choice value="search_a">A</choice>
      <choice value="search_b">B</choice>
      <choice value="search_c">C</choice>
      <choice value="search_d">D</choice>
      <choice value="search_e">E</choice>
      <choice value="search_f">F</choice>
      <change>
        <!-- http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/EventHandlerReference#Condition_element -->
        <condition label="A">
          <set token="tkn_transaction_search">txn_a</set>
        </condition>
        <condition label="B">
          <set token="tkn_transaction_search">txn_b</set>
        </condition>
        <condition label="C">
          <set token="tkn_transaction_search">txn_c</set>
        </condition>
        <condition label="D">
          <set token="tkn_transaction_search">txn_d</set>
        </condition>
        <condition label="E">
          <set token="tkn_transaction_search">txn_e</set>
        </condition>
        <condition label="F">
          <set token="tkn_transaction_search">txn_f</set>
        </condition>
      </change>
    </input>
<various_inputs> </various_inputs>
    <input type="time" searchWhenChanged="false">
      <label>Select time:</label>
      <default>
        <earliestTime>@d</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table id="results">
        <title>Your Results</title>
      </table>
    </panel>
  </row>
</form>

Any point of direction within the docs or sample code would be greatly appreciated.

0 Karma

rjthibod
Champion

There are a couple of ways of doing the kind of thing you want. One is simpler and requires more inputs, another is more complex and may not work in all cases but will reduce the number of inputs.

The first thing to know is how to use the depends= and rejects= settings on the <input> elements. You can hide or show elements of the dashboards using the tokens you are setting by referencing the tokens in the depends= and rejects= settings. For example, the following dropdown only appears when token_A and token_B are defined to some value and token_C is undefined. More details here: http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/PanelreferenceforSimplifiedXML

<input searchWhenChanged="true" token="split_field" type="dropdown" depends="$token_A$,$token_B$" rejects="$token_C$">
      <label>Split-by Field</label>
      <choice value="user">User</choice>
      <choice value="host">Host</choice>
      <choice value="domain">Domain</choice>
      <default>domain</default>
</input

So you should be able to see a way to combine tokens in a logical fashion to determine which ones are used or not. The number of combinations of inputs and what values to show in those inputs will determine how complex this gets. The other thing that will determine how complex is if you want certain values to appear in the second-level inputs based on searches that populate those values. I can't really spell a simple example here, but just be sure you test everything out.

0 Karma

_gkollias
Builder

rjthibod,

Interesting! I'll play around with this and let you know how it goes.

Thanks!

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Also @KolGr001, if still stuck by the time we do office hours again, we can work through this. In the interim, please check out the latest docs as you might notice that some of the simple xml tags you were using have been superseded by newer versions that are easier to use. If you end up nailing this then go ahead and accept @rjthibod's answer?

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...