How to group the list under one catogery/checkbox instead of displaying the entire list in drop down?

[navd]

Hi ,
I have the following sources in splunk , so I wanted to group similar ones under one category/checkbox instead of displaying the entire list in drop down

source= /var/log/message.log
source=/var/log/message1.log
source=/var/log/message2.log
source=/var/log/tmp/rmps.log

So, based on the above sources, I want to achieve this:

[dflodstrom]

Can you include the code for your dropdown as it currently is? If this list is being populated dynamically the solution will be different than if you're supplying a static list of options.

[niketn · Accepted solution]

@navd, based on the details provided you can try a dropdown like the following where token passed as base search filter for source will be $tokSource$. I have used Dropdown <change> event handler with <condition> to set the token value as required based on which option is selected.

PS: Based on sample data I have used wildcard (asterisk) match for message* logs. But you can change it as per what you need. If you are on Splunk 6.6 or higher you can use IN clause based token for source to match multiple patters/values.

<input type="dropdown" token="tokSourceGroup" searchWhenChanged="true">
  <label>Select Source Group</label>
  <choice value="*">All</choice>
  <choice value="rmps">rmps</choice>
  <choice value="messages">messages</choice>
  <change>
    <condition value="messages">
      <set token="tokSource">source="/var/log/message*.log"</set>
    </condition>
    <condition value="rmps">
      <set token="tokSource">source="/var/log/tmp/rmps.log"</set>
    </condition>
    <condition label="All">
      <set token="tokSource">source=*</set>
    </condition>
  </change>
  <default>*</default>
</input>

Please try the following run anywhere dashboard to test:

<form>
  <label>Group Source in Dropdown Options</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tokSourceGroup" searchWhenChanged="true">
      <label>Select Source Group</label>
      <choice value="*">All</choice>
      <choice value="rmps">rmps</choice>
      <choice value="messages">messages</choice>
      <change>
        <condition value="messages">
          <set token="tokSource">source="/var/log/message*.log"</set>
        </condition>
        <condition value="rmps">
          <set token="tokSource">source="/var/log/tmp/rmps.log"</set>
        </condition>
        <condition label="All">
          <set token="tokSource">source=*</set>
        </condition>
      </change>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
            | eval source="/var/log/message.log;/var/log/message1.log;/var/log/message2.log;/var/log/tmp/rmps.log"
            | makemv source delim=";"
            | mvexpand source
            | search $tokSource$
          </query>
        </search>
      </table>
    </panel>
  </row>
</form>

Please try out and confirm!

[vikashperiwal]

Hi @niketnilay ,

to this is it possible in chart, when "ALL" is selected and ALL has static values (A,B,C,D), and time chart is filtered by values, it should not show A,B,C,D in legends, rather should show only "Alphabet" in chart.

| timechart span=15m avg(x) as "session_current" by values