Splunk Search

How to clear dropdown on change?

zoebanning
Path Finder

Hello Splunk Community, 

I have created a dashboard with 3 dropdowns; Select System, Select Environment, Select Period (time). 
Note: each system has named their environments the same i.e. Production, UAT etc.

I seem to be having a problem when i have already selected all dropdowns and metrics load, then i change the System dropdown, the Environment dropdown seems to update but there is 1 duplicate (i.e. in pervious search I selected 'Production' environment and now I have 2 Production environments assuming one is for each system). 

Can someone assist me to figure out how to clear the environment dropdown when i change the system? I have tried to play around with the settings within the UI but no luck. 

Is there something i need to change in my source code? 


<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="CMDB_CI_Name" searchWhenChanged="true">
<label>Select IT Services</label>
<fieldForLabel>CMDB_CI_Name</fieldForLabel>
<fieldForValue>CMDB_CI_Name</fieldForValue>
<search>
<query>|inputlookup list.csv | fields CMDB_CI_Name | dedup CMDB_CI_Name</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</input>
<input type="dropdown" token="env" searchWhenChanged="true">
<label>Select Environment</label>
<change>
<set token="tokEnvironment">$label$</set>
</change>
<fieldForLabel>Env_Purpose</fieldForLabel>
<fieldForValue>Env_Infra</fieldForValue>
<search>
<query>|inputlookup list.csv | search CMDB_CI_Name=$CMDB_CI_Name$ | fields Env_Purpose, Env_Infra
| dedup Env_Purpose, Env_Infra</query>
</search>
</input>
<input type="time" token="time_token" searchWhenChanged="true">
<label>Time Period</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>

Labels (1)
0 Karma

zoebanning
Path Finder

Hi Giuseppe, 

I have just tried this out but i don't want an additional filter that users will need to select to refresh. Is there any other way that doesn't require an additional filter?

 

Thanks,

Zoe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zoebanning,

this is the only solution I found.

Ciao and happy splunking.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zoebanning,

please try this approach to reset all tokens.

    <input type="radio" token="resetTokens" searchWhenChanged="true">
      <label></label>
      <choice value="reset">Reset Inputs</choice>
      <choice value="retain">Retain</choice>
      <default>retain</default>
      <change>
        <condition value="reset">
          <unset token="token1"></unset>
          <unset token="token2"></unset>
          <unset token="token3"></unset>
          <set token="resetTokens">retain</set>
        </condition>
      </change>
    </input>

add it to your inputs.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...