Splunk Search

How to use a drop-down form for a search?

chandra61446
New Member

I have below search which has a CSV input (example host and category)

 host        server1     server2    server3    server4    server5
 Catagory         AP          NA         NA         EU         AP

Now I have below search which gives output

|inputlookup Messaging_Servers.csv | join type=outer max=0 host [ search sourcetype=domino-stats "Platform.Memory.RAM.TotalMBytes" ]
| join type=outer max=0 host [ search sourcetype=domino-stats "Http.Workers" ]
|table host Platform_Memory_RAM_TotalMBytes Http_Workers |dedup host  

Now I would like to have a drop-down form, and if I select AP then only server 1 and server 5 output should be shown in the dashboard with Platform_Memory_RAM_TotalMBytes and Http_Workers values.

0 Karma

thiago2d
New Member

In the Dashboard screen select Edit -> Edit Panels in the dropdown item select Edit Input and edit the token field in your search, replace the value you want for $ token $.

Dropdown Title </ label>

Default Item </ default>
Item 1 </ choice>
Item 2 </ choice>
</ Input>
</ Label>

0 Karma

kbrown_splunk
Splunk Employee
Splunk Employee

The answer is to use a token in your panel search that points to your dropdown. This is very easy to do. Please see http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/tokens

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...