Splunk Search

How to clear dropdown on change?

zoebanning
Path Finder

Hello Splunk Community, 

I have created a dashboard with 3 dropdowns; Select System, Select Environment, Select Period (time). 
Note: each system has named their environments the same i.e. Production, UAT etc.

I seem to be having a problem when i have already selected all dropdowns and metrics load, then i change the System dropdown, the Environment dropdown seems to update but there is 1 duplicate (i.e. in pervious search I selected 'Production' environment and now I have 2 Production environments assuming one is for each system). 

Can someone assist me to figure out how to clear the environment dropdown when i change the system? I have tried to play around with the settings within the UI but no luck. 

Is there something i need to change in my source code? 


<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="CMDB_CI_Name" searchWhenChanged="true">
<label>Select IT Services</label>
<fieldForLabel>CMDB_CI_Name</fieldForLabel>
<fieldForValue>CMDB_CI_Name</fieldForValue>
<search>
<query>|inputlookup list.csv | fields CMDB_CI_Name | dedup CMDB_CI_Name</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</input>
<input type="dropdown" token="env" searchWhenChanged="true">
<label>Select Environment</label>
<change>
<set token="tokEnvironment">$label$</set>
</change>
<fieldForLabel>Env_Purpose</fieldForLabel>
<fieldForValue>Env_Infra</fieldForValue>
<search>
<query>|inputlookup list.csv | search CMDB_CI_Name=$CMDB_CI_Name$ | fields Env_Purpose, Env_Infra
| dedup Env_Purpose, Env_Infra</query>
</search>
</input>
<input type="time" token="time_token" searchWhenChanged="true">
<label>Time Period</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>

0 Karma

zoebanning
Path Finder

Hi Giuseppe, 

I have just tried this out but i don't want an additional filter that users will need to select to refresh. Is there any other way that doesn't require an additional filter?

 

Thanks,

Zoe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zoebanning,

this is the only solution I found.

Ciao and happy splunking.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zoebanning,

please try this approach to reset all tokens.

    <input type="radio" token="resetTokens" searchWhenChanged="true">
      <label></label>
      <choice value="reset">Reset Inputs</choice>
      <choice value="retain">Retain</choice>
      <default>retain</default>
      <change>
        <condition value="reset">
          <unset token="token1"></unset>
          <unset token="token2"></unset>
          <unset token="token3"></unset>
          <set token="resetTokens">retain</set>
        </condition>
      </change>
    </input>

add it to your inputs.

Ciao.

Giuseppe

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Raw Data to Executive-Ready Stories, Faster

Build Data Stories for Every Audience  A dashboard is rarely just a dashboard. It might be the view an ...

Guided Onboarding with Auto-schema Is Now Generally Available

  We are excited to announce the General Availability of Guided Onboarding with Auto-Schematization ...

ATTENTION: We’re Moving! (AGAIN!)

The Splunk Community Slack is undergoing a system migration to keep our workspace secure and ...