Getting Data In

How to group the list under one catogery/checkbox instead of displaying the entire list in drop down?

navd
New Member

Hi ,
I have the following sources in splunk , so I wanted to group similar ones under one category/checkbox instead of displaying the entire list in drop down

source= /var/log/message.log
source=/var/log/message1.log
source=/var/log/message2.log
source=/var/log/tmp/rmps.log

So, based on the above sources, I want to achieve this:
alt text

0 Karma
1 Solution

niketn
Legend

@navd, based on the details provided you can try a dropdown like the following where token passed as base search filter for source will be $tokSource$. I have used Dropdown <change> event handler with <condition> to set the token value as required based on which option is selected.

PS: Based on sample data I have used wildcard (asterisk) match for message* logs. But you can change it as per what you need. If you are on Splunk 6.6 or higher you can use IN clause based token for source to match multiple patters/values.

<input type="dropdown" token="tokSourceGroup" searchWhenChanged="true">
  <label>Select Source Group</label>
  <choice value="*">All</choice>
  <choice value="rmps">rmps</choice>
  <choice value="messages">messages</choice>
  <change>
    <condition value="messages">
      <set token="tokSource">source="/var/log/message*.log"</set>
    </condition>
    <condition value="rmps">
      <set token="tokSource">source="/var/log/tmp/rmps.log"</set>
    </condition>
    <condition label="All">
      <set token="tokSource">source=*</set>
    </condition>
  </change>
  <default>*</default>
</input>

Please try the following run anywhere dashboard to test:

<form>
  <label>Group Source in Dropdown Options</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tokSourceGroup" searchWhenChanged="true">
      <label>Select Source Group</label>
      <choice value="*">All</choice>
      <choice value="rmps">rmps</choice>
      <choice value="messages">messages</choice>
      <change>
        <condition value="messages">
          <set token="tokSource">source="/var/log/message*.log"</set>
        </condition>
        <condition value="rmps">
          <set token="tokSource">source="/var/log/tmp/rmps.log"</set>
        </condition>
        <condition label="All">
          <set token="tokSource">source=*</set>
        </condition>
      </change>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
            | eval source="/var/log/message.log;/var/log/message1.log;/var/log/message2.log;/var/log/tmp/rmps.log"
            | makemv source delim=";"
            | mvexpand source
            | search $tokSource$
          </query>
        </search>
      </table>
    </panel>
  </row>
</form>

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

dflodstrom
Builder

Can you include the code for your dropdown as it currently is? If this list is being populated dynamically the solution will be different than if you're supplying a static list of options.

0 Karma

niketn
Legend

@navd, based on the details provided you can try a dropdown like the following where token passed as base search filter for source will be $tokSource$. I have used Dropdown <change> event handler with <condition> to set the token value as required based on which option is selected.

PS: Based on sample data I have used wildcard (asterisk) match for message* logs. But you can change it as per what you need. If you are on Splunk 6.6 or higher you can use IN clause based token for source to match multiple patters/values.

<input type="dropdown" token="tokSourceGroup" searchWhenChanged="true">
  <label>Select Source Group</label>
  <choice value="*">All</choice>
  <choice value="rmps">rmps</choice>
  <choice value="messages">messages</choice>
  <change>
    <condition value="messages">
      <set token="tokSource">source="/var/log/message*.log"</set>
    </condition>
    <condition value="rmps">
      <set token="tokSource">source="/var/log/tmp/rmps.log"</set>
    </condition>
    <condition label="All">
      <set token="tokSource">source=*</set>
    </condition>
  </change>
  <default>*</default>
</input>

Please try the following run anywhere dashboard to test:

<form>
  <label>Group Source in Dropdown Options</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tokSourceGroup" searchWhenChanged="true">
      <label>Select Source Group</label>
      <choice value="*">All</choice>
      <choice value="rmps">rmps</choice>
      <choice value="messages">messages</choice>
      <change>
        <condition value="messages">
          <set token="tokSource">source="/var/log/message*.log"</set>
        </condition>
        <condition value="rmps">
          <set token="tokSource">source="/var/log/tmp/rmps.log"</set>
        </condition>
        <condition label="All">
          <set token="tokSource">source=*</set>
        </condition>
      </change>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
            | eval source="/var/log/message.log;/var/log/message1.log;/var/log/message2.log;/var/log/tmp/rmps.log"
            | makemv source delim=";"
            | mvexpand source
            | search $tokSource$
          </query>
        </search>
      </table>
    </panel>
  </row>
</form>

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

vikashperiwal
Path Finder

Hi @niketnilay ,

to this is it possible in chart, when "ALL" is selected and ALL has static values (A,B,C,D), and time chart is filtered by values, it should not show A,B,C,D in legends, rather should show only "Alphabet" in chart.

| timechart span=15m avg(x) as "session_current" by values

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...