Getting Data In

How to Create Dynamic Dropdown Inputs at Search Results within a Form (Version 6.3.3)



I’m looking for a way to add dropdown inputs to the search results of a form.

I’m looking for something where the inputs are based on the initial selection from the form (so there are 6 options to choose, and each option displays different field values).

Here is a small sample of the current form:

    <![CDATA[ `$tkn_search$` $tkn$ $tkn$ $tkn$ $tkn$ $tkn$ $tkn$ $tkn$
     | `$tkn_transaction_search$`]]>
  <fieldset autoRun="false" submitButton="true">
    <input type="dropdown" searchWhenChanged="false" token="tkn_search">
      <choice value="search_a">A</choice>
      <choice value="search_b">B</choice>
      <choice value="search_c">C</choice>
      <choice value="search_d">D</choice>
      <choice value="search_e">E</choice>
      <choice value="search_f">F</choice>
        <!-- -->
        <condition label="A">
          <set token="tkn_transaction_search">txn_a</set>
        <condition label="B">
          <set token="tkn_transaction_search">txn_b</set>
        <condition label="C">
          <set token="tkn_transaction_search">txn_c</set>
        <condition label="D">
          <set token="tkn_transaction_search">txn_d</set>
        <condition label="E">
          <set token="tkn_transaction_search">txn_e</set>
        <condition label="F">
          <set token="tkn_transaction_search">txn_f</set>
<various_inputs> </various_inputs>
    <input type="time" searchWhenChanged="false">
      <label>Select time:</label>
      <table id="results">
        <title>Your Results</title>

Any point of direction within the docs or sample code would be greatly appreciated.

0 Karma


There are a couple of ways of doing the kind of thing you want. One is simpler and requires more inputs, another is more complex and may not work in all cases but will reduce the number of inputs.

The first thing to know is how to use the depends= and rejects= settings on the <input> elements. You can hide or show elements of the dashboards using the tokens you are setting by referencing the tokens in the depends= and rejects= settings. For example, the following dropdown only appears when token_A and token_B are defined to some value and token_C is undefined. More details here:

<input searchWhenChanged="true" token="split_field" type="dropdown" depends="$token_A$,$token_B$" rejects="$token_C$">
      <label>Split-by Field</label>
      <choice value="user">User</choice>
      <choice value="host">Host</choice>
      <choice value="domain">Domain</choice>

So you should be able to see a way to combine tokens in a logical fashion to determine which ones are used or not. The number of combinations of inputs and what values to show in those inputs will determine how complex this gets. The other thing that will determine how complex is if you want certain values to appear in the second-level inputs based on searches that populate those values. I can't really spell a simple example here, but just be sure you test everything out.

0 Karma



Interesting! I'll play around with this and let you know how it goes.


0 Karma

Splunk Employee
Splunk Employee

Also @KolGr001, if still stuck by the time we do office hours again, we can work through this. In the interim, please check out the latest docs as you might notice that some of the simple xml tags you were using have been superseded by newer versions that are easier to use. If you end up nailing this then go ahead and accept @rjthibod's answer?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...