Splunk Search

In a dashboard, how do you do a filter so that only certain values appear in the chart dropdown ?

kingwaras
Engager

Hi all,

I have created a dashboard as below.

But I had a problem during the chart generation.

When the first dropdown is selected ALL (*), I would like to see in my chart only the name filtered in the dropdown and not all value present in the index.

You can see below an image with an example. When I will select ALL, I would like to see only the two names showed in the dropdown and not all index value.

alt text

<form>
  <label>Users</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="NAME_ID" searchWhenChanged="true">
      <label>Towers</label>
      <choice value="*">ALL</choice>
      <fieldForLabel>name</fieldForLabel>
      <fieldForValue>Name</fieldForValue>
      <search>
        <query>| inputlookup hierarchy_lookup.csv 
 | where Level > [| inputlookup hierarchy_lookup.csv  | 
          where [| rest /services/authentication/current-context | eval accountname=mvindex(split(username,"@"),0) | table accountname | rename accountname as Name] 
            | table Level | rename Level as search] | fields Name </query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="dropdown" token="MODULE_ID" searchWhenChanged="true">
      <label>Module</label>
      <choice value="*">ALL</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>capotorre</fieldForLabel>
      <fieldForValue>module</fieldForValue>
      <search>
        <query>| inputlookup hierarchy_lookup_module.csv | search Name=$NAME_ID$ | eval module=split(Module,";") | mvexpand module | table module | dedup module | stats count by module</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>tok_ready_to_charge: $NAME_ID$&lt;br/&gt;
            | inputlookup hierarchy_lookup.csv | search Name= "$NAME_ID$" | dedup Team | table Team&lt;br/&gt;
            | inputlookup hierarchy_lookup_module.csv  | search Name=$NAME_ID$ | eval module=split(Module,";") | mvexpand module | table module&lt;br/&gt;
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Multi Value Search</title>
        <search>
          <query>index="effort_tracker"  $NAME_ID$ $MODULE_ID$ | stats count by Username</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
      </chart>
    </panel>
  </row>
</form>
Tags (2)
0 Karma
1 Solution

mykolaichuk
Engager

Hi,

You can include you input query in the chart search:

   <query> index="effort_tracker"
   ( ( [| inputlookup hierarchy_lookup.csv  | where Level > [| inputlookup hierarchy_lookup.csv 
        | where [| rest /services/authentication/current-context | eval accountname=mvindex(split(username,"@"),0) 
            | table accountname | rename accountname as Name] | table Level | rename Level as search] 
| fields Name | rename Name as Username]) AND Username=$NAME_ID$) $MODULE_ID$ 
| stats count by Username </query>

View solution in original post

0 Karma

mykolaichuk
Engager

Hi,

You can include you input query in the chart search:

   <query> index="effort_tracker"
   ( ( [| inputlookup hierarchy_lookup.csv  | where Level > [| inputlookup hierarchy_lookup.csv 
        | where [| rest /services/authentication/current-context | eval accountname=mvindex(split(username,"@"),0) 
            | table accountname | rename accountname as Name] | table Level | rename Level as search] 
| fields Name | rename Name as Username]) AND Username=$NAME_ID$) $MODULE_ID$ 
| stats count by Username </query>
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...