Getting Data In

filter a table in a dashboard from textbox

behudelson
Path Finder

Hello,

This seems like it should be straightforward but I am struggling to find a solution. I would like to filter the results shown on a table based on the value of a textbox, however the initial load of the table should not be filtered.

For example:

<search> | table ID Make Model Year

When a value is entered into a textbox field then I would like to filter the results of the table by Model only. Perhaps another textbox to filter the results on Make.

Thank you for any insights!

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

I have tried same in XML. Can you please try it?

<form>
  <init>
    <set token="form.tkn_make"></set>
    <set token="form.tkn_model"></set>
  </init>
  <label>filter a table in a dashboard from textbox</label>
  <fieldset submitButton="false">
    <input type="text" token="tkn_make" searchWhenChanged="true">
      <label>Make</label>
    </input>
    <input type="text" token="tkn_model" searchWhenChanged="true">
      <label>Model</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval ID="1", Make="MK",Model="Mo",Year="100" | where (like(lower(Make),lower("%$tkn_make$%")) OR like(lower(Model),lower("%$tkn_model$%")) ) </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

I have tried same in XML. Can you please try it?

<form>
  <init>
    <set token="form.tkn_make"></set>
    <set token="form.tkn_model"></set>
  </init>
  <label>filter a table in a dashboard from textbox</label>
  <fieldset submitButton="false">
    <input type="text" token="tkn_make" searchWhenChanged="true">
      <label>Make</label>
    </input>
    <input type="text" token="tkn_model" searchWhenChanged="true">
      <label>Model</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval ID="1", Make="MK",Model="Mo",Year="100" | where (like(lower(Make),lower("%$tkn_make$%")) OR like(lower(Model),lower("%$tkn_model$%")) ) </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Thanks

0 Karma

niketn
Legend

@kamlesh_vaghela, instead of using <init> section, I would use submit button so that search runs when user confirms after providing both model and make.

<fieldset submitButton="false">

I would also add depends to row, so that row is displayed only when both tokens are present.

<row depends="$tkn_make$,$tkn_model$">

Finally, the search query should filter results as early as possible which would be in the base search i.e.

<query>
        <YourBaseSearch> Make="$tkn_make$" Model="$tkn_model$" | <YourRemainingSearch>
</query>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

behudelson
Path Finder

This makes complete sense and worked for me. Thanks @kamlesh_vaghela.

0 Karma

Richfez
SplunkTrust
SplunkTrust

You'll want to review the Form Examples section of the Dashboards and Visualizations manual. I think most of that ought to be reasonably easy if you follow the docs.

If you get part way throughthat and have problems or questions, ask away!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...