Splunk Search

How do I make a dropdown dashboard?

smanojkumar
Contributor

Hi There,

   I had a dashboard that is having a pop up, when the single value is selected, it will display the drop down dashboard,

   I had category selection at top of the dashboard, it includes 3 category, when the other category is selected the drop down dashboard will remains same as per the previous selection of single value, I don't need drop down dashboard after the change in selection of category in dashboard, I only need dropdown dashboard when the value in the dashboard is selected.

 

Thanks in advance!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share your current dashboard source as your explanation is a little confusing.

0 Karma

smanojkumar
Contributor

<form theme="dark">
<label> Check Decision</label>
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="Category" searchWhenChanged="true">
<label>Category</label>
<choice value="work">Work</choice>
<choice value="server">Server</choice>
<choice value="auto">Auto</choice>
<default>work</default>
</input>
</fieldset>
<row>
<panel>
<title>Total Number - $Category$</title>
<single>
<title>Total Count in $Category$</title>
<search>
<query>| inputlookup $Category$_kvstore
| fields src_name, serial_number
| search src_name IN ($Src_name$)
| search serial_number IN ($Serial_number$) OR NOT serial_number!=""
| stats count(src_name) as "Total"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">all</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="form.Total">$click.value$</set>
</drilldown>
</single>
</panel>
<row>
<panel depends="$form.Total$">
<title>Total Asserts details of $form.Total$</title>
<table>
<title>Total Asserts details of count $form.Total$</title>
<search>
<query>| inputlookup $Category$kvstore
| fields src_name, serial_number
| search src_name IN ($Src_name$)
| search serial_number IN ($Serial_number$) OR NOT serial_number!=""
| table src_name</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>

 

 

I need only second panel only when i click the value in panel 1, if the category is changed, it should not display the panel 2

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Add a change handler to your drop down to unset the form.Total token

<input type="dropdown" token="Category" searchWhenChanged="true">
<label>Category</label>
<choice value="work">Work</choice>
<choice value="server">Server</choice>
<choice value="auto">Auto</choice>
<default>work</default>
<change>
  <unset token="form.Total"/>
</change>
</input>
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...