Reporting

Using more than one dropdown menu for the same search

marinalalves
Engager

Hello,

I'm trying to configure two different dropdown menus - the idea is to give option to the user, either he picks a value from the first dropdown (all videos - $dropdown_token$) OR he picks one of the top 10 ($field1$).

marinalalves_0-1596552023136.png

 

The problem is I don't seem to know how to insert this information on my visuals - the dashboard keeps running only if I select the first option/dropdown menu.

I tried different ways of writing the query, such as:

<panel>
<single>
<title>Unique Viewers</title>
<search>
<query>index=index Operation="views"
| search ResourceTitle="$dropdown_token$","$field1$"
|stats distinct_count(UserId)</query>
<earliest>$picktime_token.earliest$</earliest>
<latest>$picktime_token.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>

I also tried | search ResourceTitle="$dropdown_token$" OR "$field1$"

I know it's a beginners question but I appreciate if you could help me.

 

THanks

 

0 Karma

thambisetty
SplunkTrust
SplunkTrust

ResourceTitle="$dropdown_token$"  OR ResourceTitle="$field1$"

————————————
If this helps, give a like below.
0 Karma

marinalalves
Engager

I tried but it doesn't work - visuals keep waiting for the query to run.

0 Karma

to4kawa
Ultra Champion

sample:

<form>
  <label>double dropdown</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="dropdown_token">
      <label>dropdown1</label>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>| tstats count where index=_internal by sourcetype
| table sourcetype
| eval label=sourcetype</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="dropdown" token="field1">
      <label>dropdown2</label>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>| tstats count where index=_internal by sourcetype
| table sourcetype
| eval label=sourcetype</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="time" token="field3">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>index=_internal sourcetype=$dropdown_token$ OR sourcetype=$field1$ | head 100</query>
          <earliest>0</earliest>
          <latest></latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="type">list</option>
      </event>
    </panel>
  </row>
</form>

your simpleXML is something wrong.

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...