Dashboard drop down and input option

[sushmitha_mj]

I have created a dashboard with hourly sum(added) values for all users. In the dashboard I want to give the option of drop down to select the user name or a text box where they can enter the name of the user and the graph has to display the result of this user alone.
How can I create a drop box or text box and pass the value to the query?

[ngatchasandra]

Hi sushmitha,
In your dashbaord, edit panel and add dropdown input type. Click on pen who is on input that you added.

To configure it, see the Splunk viz manual where you are going to see, Follow the link
http://docs.splunk.com/Documentation/Splunk/latest/Viz/Aboutthismanual

You will see all diffferents types of input form configuratioons.

This is an example:

 <input type="dropdown" token="user">
    <label>Select User</label>
    <populatingSearch fieldForLabel="user" fieldForValue="user">index=...|stats count by user</populatingSearch>
    <default> Default user to see on input</default>
  </input>

and call the token in your search panel like

<panel>
       <title>User panel</title>
       <table>

         <search>
           <query>index=...  user=$user$|.....</query>
         </search>
         <option name="wrap">true</option>
         <option name="rowNumbers">false</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">cell</option>
         <option name="count">10</option>
       </table>

[sushmitha_mj]

It worked...
Thanks...

[Patient · Accepted solution]

Hi sushmitha,

You can create a Dropdown or text box using this simple xml code to Display the results in a table. The following is the complete dynamic form search:

<form>
  <label>Username</label>
  <searchTemplate>sourcetype=logins $username$</searchTemplate>  
  <fieldset>
    <input type="dropdown" token="username">
       <label>Select Name</label>
       <populatingSearch fieldForValue="user" fieldForLabel="user">
          <![CDATA[sourcetype=YourSourcetype
          | stats count by user]]>
        </populatingSearch>
    </input>
  </fieldset>

  <row>
    <table>
      <title>User</title>
        <option name="showPager">true</option>
      </table>
  </row>
</form>

If You have your customize search wich populate your dashboard, yo can replace the

 <row> ....  </row> with the below code:

<row>
    <panel>
        <event>
                  <searchString>index=your_Index  User=$username$ | ....  </searchString>
            <earliestTime/>
            <latestTime/>
          </event>
      </panel>
  </row>

[sushmitha_mj]

It worked...
Thanks...

[Patient]

Thank you for your vote!