Splunk Search

Splunk dashboard dynamic filter by multiple filter tokens

elend
Path Finder

I created a splunk dashboard that has a lot of filters (multiple dropdowns), and text input with different tokens, and with dynamic tables too. I want make it dynamic foreach filter that I choose, but for now it still can't be dynamic for every existing output and filter.
Here my xml:

 

 

<form version="1.1" theme="dark">
  <label>Dashboard Overview</label>
  <fieldset submitButton="false">
    <input type="time" token="global_time" searchWhenChanged="true">
      <label>Select Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="owner" searchWhenChanged="true">
      <label>Select Owner</label>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>owner</fieldForLabel>
      <fieldForValue>owner</fieldForValue>
      <search>
        <query>index=db_warehouse 
| dedup owner
| fields owner
| table owner</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="dropdown" token="hostname" searchWhenChanged="true">
      <label>Select Hostname</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>hostname</fieldForLabel>
      <fieldForValue>hostname</fieldForValue>
      <search>
        <query>index=db_warehouse hostname=$hostname$ owner=$owner$ ipaddress=$ipaddress$ cve=$cve$ cve=$cve$
| dedup hostname
| fields hostname
| table hostname</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <initialValue>*</initialValue>
    </input>
    <input type="dropdown" token="ipaddress" searchWhenChanged="true">
      <label>Select by IP Address</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>ipaddress</fieldForLabel>
      <fieldForValue>dest</fieldForValue>
      <search>
        <query>index=db_warehouse
| search hostname=$hostname$ owner=$owner$ ipaddress=$ipaddress$ cve=$cve$
| dedup dest
| fields dest
| table dest</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="text" token="cve">
      <label>Search CVE</label>
      <default>*</default>
    </input>
  </fieldset>
      <table>
        <title>Detail Information Table</title>
        <search>
          <query>index=db_warehouse 
| fields _time, hostname, dest, mac_address, vulnerability_title, os_version, os_description, severity, cvss_score, last_assessed_for_vulnerabilities, solution_types,cve, owner, dest_category
| search hostname=$hostname$ owner=$owner$ ipaddress=$ipaddress$ cve=$cve$
| rename dest as ip, dest_category as category
| table _time, hostname, ip, mac_address, vulnerability_title, owner, category, cve, os_version, os_description, severity, cvss_score, last_assessed_for_vulnerabilities, solution_types
| dedup hostname</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>

 

 

 Is there any reference or solution for this?

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what you are trying to achieve here - you already have your tokens in your table search!

btw, your ipaddress dropdown has a fieldForLabel with is not returned by the search.

0 Karma

elend
Path Finder

to make it clear about the existing condition. There is a list of hostname & ip that have different owner, also null owner and by default the hostname dropdown only show list hostname that have owner value, and not show the hostname that doesnt have owner. How to refine this?
Following is the related capture:
dashboard filter.jpeg

and this for the search output:

search-owner.jpeg


0 Karma

elend
Path Finder

sorry if it's not clear,
For example, there is
Hostnames A, B, C
is X owner

Hostnames D, E, F
is the Y owner.

I want each filter to be bound to tokens on other filters. So, for example, if I set the owner filter to value X, the dropdown on Hostname filter only displays A, B, C. Or if I choose hosntname A, the owner filter only show X value, is it possible?

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...