Reporting

Using more than one dropdown menu for the same search

marinalalves
Engager

Hello,

I'm trying to configure two different dropdown menus - the idea is to give option to the user, either he picks a value from the first dropdown (all videos - $dropdown_token$) OR he picks one of the top 10 ($field1$).

marinalalves_0-1596552023136.png

 

The problem is I don't seem to know how to insert this information on my visuals - the dashboard keeps running only if I select the first option/dropdown menu.

I tried different ways of writing the query, such as:

<panel>
<single>
<title>Unique Viewers</title>
<search>
<query>index=index Operation="views"
| search ResourceTitle="$dropdown_token$","$field1$"
|stats distinct_count(UserId)</query>
<earliest>$picktime_token.earliest$</earliest>
<latest>$picktime_token.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>

I also tried | search ResourceTitle="$dropdown_token$" OR "$field1$"

I know it's a beginners question but I appreciate if you could help me.

 

THanks

 

0 Karma

thambisetty
SplunkTrust
SplunkTrust

ResourceTitle="$dropdown_token$"  OR ResourceTitle="$field1$"

————————————
If this helps, give a like below.
0 Karma

marinalalves
Engager

I tried but it doesn't work - visuals keep waiting for the query to run.

0 Karma

to4kawa
Ultra Champion

sample:

<form>
  <label>double dropdown</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="dropdown_token">
      <label>dropdown1</label>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>| tstats count where index=_internal by sourcetype
| table sourcetype
| eval label=sourcetype</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="dropdown" token="field1">
      <label>dropdown2</label>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>| tstats count where index=_internal by sourcetype
| table sourcetype
| eval label=sourcetype</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="time" token="field3">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>index=_internal sourcetype=$dropdown_token$ OR sourcetype=$field1$ | head 100</query>
          <earliest>0</earliest>
          <latest></latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="type">list</option>
      </event>
    </panel>
  </row>
</form>

your simpleXML is something wrong.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...