Splunk Search

How to use a drop-down form for a search?

chandra61446
New Member

I have below search which has a CSV input (example host and category)

 host        server1     server2    server3    server4    server5
 Catagory         AP          NA         NA         EU         AP

Now I have below search which gives output

|inputlookup Messaging_Servers.csv | join type=outer max=0 host [ search sourcetype=domino-stats "Platform.Memory.RAM.TotalMBytes" ]
| join type=outer max=0 host [ search sourcetype=domino-stats "Http.Workers" ]
|table host Platform_Memory_RAM_TotalMBytes Http_Workers |dedup host  

Now I would like to have a drop-down form, and if I select AP then only server 1 and server 5 output should be shown in the dashboard with Platform_Memory_RAM_TotalMBytes and Http_Workers values.

0 Karma

thiago2d
New Member

In the Dashboard screen select Edit -> Edit Panels in the dropdown item select Edit Input and edit the token field in your search, replace the value you want for $ token $.

Dropdown Title </ label>

Default Item </ default>
Item 1 </ choice>
Item 2 </ choice>
</ Input>
</ Label>

0 Karma

kbrown_splunk
Splunk Employee
Splunk Employee

The answer is to use a token in your panel search that points to your dropdown. This is very easy to do. Please see http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/tokens

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...