Splunk Search

Splunk dashboard dynamic filter by multiple filter tokens

elend
Communicator

I created a splunk dashboard that has a lot of filters (multiple dropdowns), and text input with different tokens, and with dynamic tables too. I want make it dynamic foreach filter that I choose, but for now it still can't be dynamic for every existing output and filter.
Here my xml:

 

 

<form version="1.1" theme="dark">
  <label>Dashboard Overview</label>
  <fieldset submitButton="false">
    <input type="time" token="global_time" searchWhenChanged="true">
      <label>Select Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="owner" searchWhenChanged="true">
      <label>Select Owner</label>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>owner</fieldForLabel>
      <fieldForValue>owner</fieldForValue>
      <search>
        <query>index=db_warehouse 
| dedup owner
| fields owner
| table owner</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="dropdown" token="hostname" searchWhenChanged="true">
      <label>Select Hostname</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>hostname</fieldForLabel>
      <fieldForValue>hostname</fieldForValue>
      <search>
        <query>index=db_warehouse hostname=$hostname$ owner=$owner$ ipaddress=$ipaddress$ cve=$cve$ cve=$cve$
| dedup hostname
| fields hostname
| table hostname</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <initialValue>*</initialValue>
    </input>
    <input type="dropdown" token="ipaddress" searchWhenChanged="true">
      <label>Select by IP Address</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>ipaddress</fieldForLabel>
      <fieldForValue>dest</fieldForValue>
      <search>
        <query>index=db_warehouse
| search hostname=$hostname$ owner=$owner$ ipaddress=$ipaddress$ cve=$cve$
| dedup dest
| fields dest
| table dest</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="text" token="cve">
      <label>Search CVE</label>
      <default>*</default>
    </input>
  </fieldset>
      <table>
        <title>Detail Information Table</title>
        <search>
          <query>index=db_warehouse 
| fields _time, hostname, dest, mac_address, vulnerability_title, os_version, os_description, severity, cvss_score, last_assessed_for_vulnerabilities, solution_types,cve, owner, dest_category
| search hostname=$hostname$ owner=$owner$ ipaddress=$ipaddress$ cve=$cve$
| rename dest as ip, dest_category as category
| table _time, hostname, ip, mac_address, vulnerability_title, owner, category, cve, os_version, os_description, severity, cvss_score, last_assessed_for_vulnerabilities, solution_types
| dedup hostname</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>

 

 

 Is there any reference or solution for this?

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what you are trying to achieve here - you already have your tokens in your table search!

btw, your ipaddress dropdown has a fieldForLabel with is not returned by the search.

0 Karma

elend
Communicator

to make it clear about the existing condition. There is a list of hostname & ip that have different owner, also null owner and by default the hostname dropdown only show list hostname that have owner value, and not show the hostname that doesnt have owner. How to refine this?
Following is the related capture:
dashboard filter.jpeg

and this for the search output:

search-owner.jpeg


0 Karma

elend
Communicator

sorry if it's not clear,
For example, there is
Hostnames A, B, C
is X owner

Hostnames D, E, F
is the Y owner.

I want each filter to be bound to tokens on other filters. So, for example, if I set the owner filter to value X, the dropdown on Hostname filter only displays A, B, C. Or if I choose hosntname A, the owner filter only show X value, is it possible?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

The Trust Gap: Why a Data Foundation is Fundamental to an Agentic Enterprise

The Trust Gap: Why a data foundation is fundamental to an  Agentic Enterprise.   Agentic AI is transforming ...

Data Management Digest – September 2026

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of ...