Splunk Search

In a dashboard, how do you do a filter so that only certain values appear in the chart dropdown ?

kingwaras
Engager

Hi all,

I have created a dashboard as below.

But I had a problem during the chart generation.

When the first dropdown is selected ALL (*), I would like to see in my chart only the name filtered in the dropdown and not all value present in the index.

You can see below an image with an example. When I will select ALL, I would like to see only the two names showed in the dropdown and not all index value.

alt text

<form>
  <label>Users</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="NAME_ID" searchWhenChanged="true">
      <label>Towers</label>
      <choice value="*">ALL</choice>
      <fieldForLabel>name</fieldForLabel>
      <fieldForValue>Name</fieldForValue>
      <search>
        <query>| inputlookup hierarchy_lookup.csv 
 | where Level > [| inputlookup hierarchy_lookup.csv  | 
          where [| rest /services/authentication/current-context | eval accountname=mvindex(split(username,"@"),0) | table accountname | rename accountname as Name] 
            | table Level | rename Level as search] | fields Name </query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="dropdown" token="MODULE_ID" searchWhenChanged="true">
      <label>Module</label>
      <choice value="*">ALL</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>capotorre</fieldForLabel>
      <fieldForValue>module</fieldForValue>
      <search>
        <query>| inputlookup hierarchy_lookup_module.csv | search Name=$NAME_ID$ | eval module=split(Module,";") | mvexpand module | table module | dedup module | stats count by module</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>tok_ready_to_charge: $NAME_ID$&lt;br/&gt;
            | inputlookup hierarchy_lookup.csv | search Name= "$NAME_ID$" | dedup Team | table Team&lt;br/&gt;
            | inputlookup hierarchy_lookup_module.csv  | search Name=$NAME_ID$ | eval module=split(Module,";") | mvexpand module | table module&lt;br/&gt;
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Multi Value Search</title>
        <search>
          <query>index="effort_tracker"  $NAME_ID$ $MODULE_ID$ | stats count by Username</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
      </chart>
    </panel>
  </row>
</form>
Tags (2)
0 Karma
1 Solution

mykolaichuk
Engager

Hi,

You can include you input query in the chart search:

   <query> index="effort_tracker"
   ( ( [| inputlookup hierarchy_lookup.csv  | where Level > [| inputlookup hierarchy_lookup.csv 
        | where [| rest /services/authentication/current-context | eval accountname=mvindex(split(username,"@"),0) 
            | table accountname | rename accountname as Name] | table Level | rename Level as search] 
| fields Name | rename Name as Username]) AND Username=$NAME_ID$) $MODULE_ID$ 
| stats count by Username </query>

View solution in original post

0 Karma

mykolaichuk
Engager

Hi,

You can include you input query in the chart search:

   <query> index="effort_tracker"
   ( ( [| inputlookup hierarchy_lookup.csv  | where Level > [| inputlookup hierarchy_lookup.csv 
        | where [| rest /services/authentication/current-context | eval accountname=mvindex(split(username,"@"),0) 
            | table accountname | rename accountname as Name] | table Level | rename Level as search] 
| fields Name | rename Name as Username]) AND Username=$NAME_ID$) $MODULE_ID$ 
| stats count by Username </query>
0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...