Getting Data In

filter a table in a dashboard from textbox

behudelson
Path Finder

Hello,

This seems like it should be straightforward but I am struggling to find a solution. I would like to filter the results shown on a table based on the value of a textbox, however the initial load of the table should not be filtered.

For example:

<search> | table ID Make Model Year

When a value is entered into a textbox field then I would like to filter the results of the table by Model only. Perhaps another textbox to filter the results on Make.

Thank you for any insights!

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

I have tried same in XML. Can you please try it?

<form>
  <init>
    <set token="form.tkn_make"></set>
    <set token="form.tkn_model"></set>
  </init>
  <label>filter a table in a dashboard from textbox</label>
  <fieldset submitButton="false">
    <input type="text" token="tkn_make" searchWhenChanged="true">
      <label>Make</label>
    </input>
    <input type="text" token="tkn_model" searchWhenChanged="true">
      <label>Model</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval ID="1", Make="MK",Model="Mo",Year="100" | where (like(lower(Make),lower("%$tkn_make$%")) OR like(lower(Model),lower("%$tkn_model$%")) ) </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

I have tried same in XML. Can you please try it?

<form>
  <init>
    <set token="form.tkn_make"></set>
    <set token="form.tkn_model"></set>
  </init>
  <label>filter a table in a dashboard from textbox</label>
  <fieldset submitButton="false">
    <input type="text" token="tkn_make" searchWhenChanged="true">
      <label>Make</label>
    </input>
    <input type="text" token="tkn_model" searchWhenChanged="true">
      <label>Model</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval ID="1", Make="MK",Model="Mo",Year="100" | where (like(lower(Make),lower("%$tkn_make$%")) OR like(lower(Model),lower("%$tkn_model$%")) ) </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Thanks

0 Karma

@kamlesh_vaghela, instead of using <init> section, I would use submit button so that search runs when user confirms after providing both model and make.

<fieldset submitButton="false">

I would also add depends to row, so that row is displayed only when both tokens are present.

<row depends="$tkn_make$,$tkn_model$">

Finally, the search query should filter results as early as possible which would be in the base search i.e.

<query>
        <YourBaseSearch> Make="$tkn_make$" Model="$tkn_model$" | <YourRemainingSearch>
</query>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

behudelson
Path Finder

This makes complete sense and worked for me. Thanks @kamlesh_vaghela.

0 Karma

Richfez
SplunkTrust
SplunkTrust

You'll want to review the Form Examples section of the Dashboards and Visualizations manual. I think most of that ought to be reasonably easy if you follow the docs.

If you get part way throughthat and have problems or questions, ask away!

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...