Splunk Search

How do I make a dropdown dashboard?

smanojkumar
Contributor

Hi There,

   I had a dashboard that is having a pop up, when the single value is selected, it will display the drop down dashboard,

   I had category selection at top of the dashboard, it includes 3 category, when the other category is selected the drop down dashboard will remains same as per the previous selection of single value, I don't need drop down dashboard after the change in selection of category in dashboard, I only need dropdown dashboard when the value in the dashboard is selected.

 

Thanks in advance!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share your current dashboard source as your explanation is a little confusing.

0 Karma

smanojkumar
Contributor

<form theme="dark">
<label> Check Decision</label>
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="Category" searchWhenChanged="true">
<label>Category</label>
<choice value="work">Work</choice>
<choice value="server">Server</choice>
<choice value="auto">Auto</choice>
<default>work</default>
</input>
</fieldset>
<row>
<panel>
<title>Total Number - $Category$</title>
<single>
<title>Total Count in $Category$</title>
<search>
<query>| inputlookup $Category$_kvstore
| fields src_name, serial_number
| search src_name IN ($Src_name$)
| search serial_number IN ($Serial_number$) OR NOT serial_number!=""
| stats count(src_name) as "Total"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">all</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="form.Total">$click.value$</set>
</drilldown>
</single>
</panel>
<row>
<panel depends="$form.Total$">
<title>Total Asserts details of $form.Total$</title>
<table>
<title>Total Asserts details of count $form.Total$</title>
<search>
<query>| inputlookup $Category$kvstore
| fields src_name, serial_number
| search src_name IN ($Src_name$)
| search serial_number IN ($Serial_number$) OR NOT serial_number!=""
| table src_name</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>

 

 

I need only second panel only when i click the value in panel 1, if the category is changed, it should not display the panel 2

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Add a change handler to your drop down to unset the form.Total token

<input type="dropdown" token="Category" searchWhenChanged="true">
<label>Category</label>
<choice value="work">Work</choice>
<choice value="server">Server</choice>
<choice value="auto">Auto</choice>
<default>work</default>
<change>
  <unset token="form.Total"/>
</change>
</input>
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...