Splunk Search

How to clear dropdown on change?

zoebanning
Path Finder

Hello Splunk Community, 

I have created a dashboard with 3 dropdowns; Select System, Select Environment, Select Period (time). 
Note: each system has named their environments the same i.e. Production, UAT etc.

I seem to be having a problem when i have already selected all dropdowns and metrics load, then i change the System dropdown, the Environment dropdown seems to update but there is 1 duplicate (i.e. in pervious search I selected 'Production' environment and now I have 2 Production environments assuming one is for each system). 

Can someone assist me to figure out how to clear the environment dropdown when i change the system? I have tried to play around with the settings within the UI but no luck. 

Is there something i need to change in my source code? 


<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="CMDB_CI_Name" searchWhenChanged="true">
<label>Select IT Services</label>
<fieldForLabel>CMDB_CI_Name</fieldForLabel>
<fieldForValue>CMDB_CI_Name</fieldForValue>
<search>
<query>|inputlookup list.csv | fields CMDB_CI_Name | dedup CMDB_CI_Name</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</input>
<input type="dropdown" token="env" searchWhenChanged="true">
<label>Select Environment</label>
<change>
<set token="tokEnvironment">$label$</set>
</change>
<fieldForLabel>Env_Purpose</fieldForLabel>
<fieldForValue>Env_Infra</fieldForValue>
<search>
<query>|inputlookup list.csv | search CMDB_CI_Name=$CMDB_CI_Name$ | fields Env_Purpose, Env_Infra
| dedup Env_Purpose, Env_Infra</query>
</search>
</input>
<input type="time" token="time_token" searchWhenChanged="true">
<label>Time Period</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>

Labels (1)
0 Karma

zoebanning
Path Finder

Hi Giuseppe, 

I have just tried this out but i don't want an additional filter that users will need to select to refresh. Is there any other way that doesn't require an additional filter?

 

Thanks,

Zoe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zoebanning,

this is the only solution I found.

Ciao and happy splunking.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zoebanning,

please try this approach to reset all tokens.

    <input type="radio" token="resetTokens" searchWhenChanged="true">
      <label></label>
      <choice value="reset">Reset Inputs</choice>
      <choice value="retain">Retain</choice>
      <default>retain</default>
      <change>
        <condition value="reset">
          <unset token="token1"></unset>
          <unset token="token2"></unset>
          <unset token="token3"></unset>
          <set token="resetTokens">retain</set>
        </condition>
      </change>
    </input>

add it to your inputs.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...