Splunk Dev

A dropdown menu within a panel and change in the search query based on input selection

ssamant007
Explorer

I want to add a dropdown selection menu inside a dashboard panel using html and then based on the selected item from the dropdown , need to change the search query accordingly and results are updated in the chart visualization.

Example:

 Select Month:   All, Jan, Feb, ...Dec.

Now when user selects all, the query will display results for entire year (jan -dec) and when jan is selected then chart is displayed only showing the entire january data. Similarly for others.

I have other different panels within the dashboard under differet rows, and  I need to insert the drop down menu only for a specific panel. Also, my base search remains same irrespective of the drop-down selection, only the panel search string changes with change in the dropdown selection.

- any suggestion or guide would be a great help. It would be nice if it can be done with no or minimal use of JavaScript.

TIA

thanks

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Add a dropdown input to the row with the panel you want to filter and use the token from the dropdown in the search for that panel. The search can still be based on your initial search query, it is just applying some filtering.

View solution in original post

ssamant007
Explorer

Thanks @ITWhisperer  & @RickvdlJ . I built the solution based on the idea suggested.

0 Karma

RickvdIJ
Explorer

<row>

    <panel>

      <title>panel_in_dashboard</title>

      <input type="dropdown" token="hosttoken">

        <label>host-token</label>

        <fieldForLabel>host</fieldForLabel>

        <fieldForValue>host</fieldForValue>

        <search>

          <query>| tstats c where index=test by host | table host</query>

          <earliest>-15m@m</earliest>

          <latest>now</latest>

        </search>

      </input>

      <chart>

        <title>test</title>

        <search>

          <query>| tstats c where index=test host=$hosttoken$ by host</query>

          <earliest>-15m@m</earliest>

          <latest>now</latest>

        </search>

        <option name="charting.chart">line</option>

        <option name="charting.drilldown">none</option>

        <option name="refresh.display">progressbar</option>

      </chart>

    </panel>

 

-----

Now you have a dropdown menu in your dashboard panel with a token. This token is used in the panel-search.

Currently, the dropdown is populated by a search, but you can also include static values.

ITWhisperer
SplunkTrust
SplunkTrust

Add a dropdown input to the row with the panel you want to filter and use the token from the dropdown in the search for that panel. The search can still be based on your initial search query, it is just applying some filtering.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...