Using Lookups to dynamically populate a dashboard

[davidpaper]

I would like to use a lookup table with multiple columns to populate multiple fields for use later in a dashboard. Specifics look like this:

dropdown_input,index,sourcetype,source
value1,val1_data,val1_srctype,val1_source
value2,val2_data,val2_srctype,val2_source

I want to use the dropdown_input as a pulldown selector, and when submitted, to have $dropdown_input$, $index$, $sourcetype$, and $source$ available for use in SPL queries.

[martin_mueller · Accepted solution]

This should do:

<input type="dropdown" token="magic" searchWhenChanged="true">
  <label>Choose Service</label>
  <search>
    <query>| inputlookup cerby.csv | eval magic = index . "#c#e#r#b#y#" . sourcetype . "#c#e#r#b#y#" . source</query>
  </search>
  <selectFirstChoice>true</selectFirstChoice>
  <fieldForLabel>dropdown_input</fieldForLabel>
  <fieldForValue>magic</fieldForValue>
  <change>
    <condition value="*">
      <eval token="index">mvindex(split($value$, "#c#e#r#b#y#"), 0, 0)</eval>
      <eval token="sourcetype">mvindex(split($value$, "#c#e#r#b#y#"), 1, 1)</eval>
      <eval token="source">mvindex(split($value$, "#c#e#r#b#y#"), 2, 2)</eval>
    </condition>
  </change>
</input>

The input itself can only set one token, so this sets a magic token containing several tokens that then get extracted into individual tokens.

[rjthibod]

Are JS extensions in splunkjs an option or are you required to only use Simple XML?

[davidpaper]

Only Simple XML.