Reporting

Using more than one dropdown menu for the same search

marinalalves
Engager

Hello,

I'm trying to configure two different dropdown menus - the idea is to give option to the user, either he picks a value from the first dropdown (all videos - $dropdown_token$) OR he picks one of the top 10 ($field1$).

marinalalves_0-1596552023136.png

 

The problem is I don't seem to know how to insert this information on my visuals - the dashboard keeps running only if I select the first option/dropdown menu.

I tried different ways of writing the query, such as:

<panel>
<single>
<title>Unique Viewers</title>
<search>
<query>index=index Operation="views"
| search ResourceTitle="$dropdown_token$","$field1$"
|stats distinct_count(UserId)</query>
<earliest>$picktime_token.earliest$</earliest>
<latest>$picktime_token.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>

I also tried | search ResourceTitle="$dropdown_token$" OR "$field1$"

I know it's a beginners question but I appreciate if you could help me.

 

THanks

 

Labels (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

ResourceTitle="$dropdown_token$"  OR ResourceTitle="$field1$"

————————————
If this helps, give a like below.
0 Karma

marinalalves
Engager

I tried but it doesn't work - visuals keep waiting for the query to run.

0 Karma

to4kawa
Ultra Champion

sample:

<form>
  <label>double dropdown</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="dropdown_token">
      <label>dropdown1</label>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>| tstats count where index=_internal by sourcetype
| table sourcetype
| eval label=sourcetype</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="dropdown" token="field1">
      <label>dropdown2</label>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>| tstats count where index=_internal by sourcetype
| table sourcetype
| eval label=sourcetype</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="time" token="field3">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>index=_internal sourcetype=$dropdown_token$ OR sourcetype=$field1$ | head 100</query>
          <earliest>0</earliest>
          <latest></latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="type">list</option>
      </event>
    </panel>
  </row>
</form>

your simpleXML is something wrong.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...