Splunk Search

How to clear dropdown on change?

zoebanning
Path Finder

Hello Splunk Community, 

I have created a dashboard with 3 dropdowns; Select System, Select Environment, Select Period (time). 
Note: each system has named their environments the same i.e. Production, UAT etc.

I seem to be having a problem when i have already selected all dropdowns and metrics load, then i change the System dropdown, the Environment dropdown seems to update but there is 1 duplicate (i.e. in pervious search I selected 'Production' environment and now I have 2 Production environments assuming one is for each system). 

Can someone assist me to figure out how to clear the environment dropdown when i change the system? I have tried to play around with the settings within the UI but no luck. 

Is there something i need to change in my source code? 


<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="CMDB_CI_Name" searchWhenChanged="true">
<label>Select IT Services</label>
<fieldForLabel>CMDB_CI_Name</fieldForLabel>
<fieldForValue>CMDB_CI_Name</fieldForValue>
<search>
<query>|inputlookup list.csv | fields CMDB_CI_Name | dedup CMDB_CI_Name</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</input>
<input type="dropdown" token="env" searchWhenChanged="true">
<label>Select Environment</label>
<change>
<set token="tokEnvironment">$label$</set>
</change>
<fieldForLabel>Env_Purpose</fieldForLabel>
<fieldForValue>Env_Infra</fieldForValue>
<search>
<query>|inputlookup list.csv | search CMDB_CI_Name=$CMDB_CI_Name$ | fields Env_Purpose, Env_Infra
| dedup Env_Purpose, Env_Infra</query>
</search>
</input>
<input type="time" token="time_token" searchWhenChanged="true">
<label>Time Period</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>

0 Karma

zoebanning
Path Finder

Hi Giuseppe, 

I have just tried this out but i don't want an additional filter that users will need to select to refresh. Is there any other way that doesn't require an additional filter?

 

Thanks,

Zoe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zoebanning,

this is the only solution I found.

Ciao and happy splunking.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zoebanning,

please try this approach to reset all tokens.

    <input type="radio" token="resetTokens" searchWhenChanged="true">
      <label></label>
      <choice value="reset">Reset Inputs</choice>
      <choice value="retain">Retain</choice>
      <default>retain</default>
      <change>
        <condition value="reset">
          <unset token="token1"></unset>
          <unset token="token2"></unset>
          <unset token="token3"></unset>
          <set token="resetTokens">retain</set>
        </condition>
      </change>
    </input>

add it to your inputs.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...