Join the Conversation
- Find Answers
- :
- Splunk Products
- :
- Splunk Enterprise
- :
- Dynamic dashboard drop-down
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Dynamic dashboard drop-down
Hi Splunkers,
Long time listener, first time caller. I am trying to figure out how to make a dashboard based on a monthly vulnerability scan.
Our previous implementation was using relative dates to generate a dashboard, but that was highly dependent on everything going right.
I copy/pasted my way to a mostly-working dashboard from this community. Hoping I can get some help to get the rest of the way there.
The new implementation uses a ScanID from the report.csv.
My dashboard has a drop-down which doesn't let me select anything, but automatically selects the latest scanID (and dynamically assigns the previous month's ScanIDs for comparison/trendlines). I'd like to be able to use the drop down to review last month's report as well though.
Examples:
ScanID's:
This month: 999999
Last month: 888888
Previous Month: 777777
etc.
So as it stands the dashboard automatically performs a search and assigns the following tokens:
<set token="Scan1">$result.row 1$</set>
<set token="Scan2">$result.row 2$</set>
<set token="Scan3">$result.row 3$</set>
<set token="Scan4">$result.row 4$</set>
I'd like to be able to click the drop-down and select ScanID 888888 and have it automatically assign the token to "Scan1", and dynamically set "Scan2" to ScanID 777777 and so on.
Hope I've explained it well enough. Below is my sample (anonymized dashboard xml/source). Thanks in advance!
<form theme="dark">
<label>dropdown dashboard</label>
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="Scan1" searchWhenChanged="true">
<label>Select a Report</label>
<search>
<query>index="fakeindex"
| dedup ScanID
| table ScanID
| head 6
| sort - ScanID
| transpose </query>
<earliest>-6mon@mon</earliest>
<latest>now</latest>
<done>
<set token="Scan1">$result.row 1$</set>
<set token="Scan2">$result.row 2$</set>
<set token="Scan3">$result.row 3$</set>
<set token="Scan4">$result.row 4$</set>
</done>
</search>
</input>
</fieldset>
<row>
<panel>
<title>Panel for Debugging Token:</title>
<html>
Upercase $ScanX$
<div>This Month: $Scan1$</div>
<div>Last Month: $Scan2$</div>
<div>Prev Month: $Scan3$</div>
</html>
</panel>
</row>
[example search that required multiple scanID's]
<single>
<search>
<query>index="fakeindex" sourcetype=fakesourcetype ScanID=$Scan2$
NOT
[ search index="fakeindex" sourcetype=fakesourcetype ScanID=$Scan3$
| stats count by somevalue
| table somevalue]
| dedup somevalue ScanID
| stats count(somevalue) as EVENTS
| eval period="Last Month"
| append
[ search index="fakeindex" sourcetype=fakesourcetype ScanID=$Scan1$
NOT
[ search index="fakeindex" sourcetype=fakesourcetype ScanID=$Scan2$
| stats count by somevalue
| table somevalue]
| dedup somevalue ScanID
| stats count(somevalue) as EVENTS
| eval period="This Month"
]
| fields EVENTS period _time</query>
<earliest>-6mos@mos</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="colorBy">trend</option>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">inverse</option>
<option name="trendDisplayMode">absolute</option>
<option name="underLabel">New</option>
<option name="unitPosition">before</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
</single>
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
