Splunk Search

How do I make a dropdown dashboard?

smanojkumar
Contributor

Hi There,

   I had a dashboard that is having a pop up, when the single value is selected, it will display the drop down dashboard,

   I had category selection at top of the dashboard, it includes 3 category, when the other category is selected the drop down dashboard will remains same as per the previous selection of single value, I don't need drop down dashboard after the change in selection of category in dashboard, I only need dropdown dashboard when the value in the dashboard is selected.

 

Thanks in advance!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share your current dashboard source as your explanation is a little confusing.

0 Karma

smanojkumar
Contributor

<form theme="dark">
<label> Check Decision</label>
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="Category" searchWhenChanged="true">
<label>Category</label>
<choice value="work">Work</choice>
<choice value="server">Server</choice>
<choice value="auto">Auto</choice>
<default>work</default>
</input>
</fieldset>
<row>
<panel>
<title>Total Number - $Category$</title>
<single>
<title>Total Count in $Category$</title>
<search>
<query>| inputlookup $Category$_kvstore
| fields src_name, serial_number
| search src_name IN ($Src_name$)
| search serial_number IN ($Serial_number$) OR NOT serial_number!=""
| stats count(src_name) as "Total"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">all</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="form.Total">$click.value$</set>
</drilldown>
</single>
</panel>
<row>
<panel depends="$form.Total$">
<title>Total Asserts details of $form.Total$</title>
<table>
<title>Total Asserts details of count $form.Total$</title>
<search>
<query>| inputlookup $Category$kvstore
| fields src_name, serial_number
| search src_name IN ($Src_name$)
| search serial_number IN ($Serial_number$) OR NOT serial_number!=""
| table src_name</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>

 

 

I need only second panel only when i click the value in panel 1, if the category is changed, it should not display the panel 2

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Add a change handler to your drop down to unset the form.Total token

<input type="dropdown" token="Category" searchWhenChanged="true">
<label>Category</label>
<choice value="work">Work</choice>
<choice value="server">Server</choice>
<choice value="auto">Auto</choice>
<default>work</default>
<change>
  <unset token="form.Total"/>
</change>
</input>
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

    Thursday, June 25, 2026  |  11AM PDT / 2PM EDT  Duration: 1 Hour (Includes live Q&A) Register to ...

Analytics Workspace deprecation

As of Splunk Cloud Platform 10.4.2604 and Splunk Enterprise 10.4, Analytics Workspace is now deprecated. ...

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

Splunk Developer Day brought the Splunk developer community together for a practical look at what it means to ...