Splunk Search

Using Lookups to dynamically populate a dashboard

Contributor

I would like to use a lookup table with multiple columns to populate multiple fields for use later in a dashboard. Specifics look like this:

dropdown_input,index,sourcetype,source
value1,val1data,val1srctype,val1source
value2,val2
data,val2srctype,val2source

I want to use the dropdowninput as a pulldown selector, and when submitted, to have $dropdowninput$, $index$, $sourcetype$, and $source$ available for use in SPL queries.

1 Solution

SplunkTrust
SplunkTrust

This should do:

<input type="dropdown" token="magic" searchWhenChanged="true">
  <label>Choose Service</label>
  <search>
    <query>| inputlookup cerby.csv | eval magic = index . "#c#e#r#b#y#" . sourcetype . "#c#e#r#b#y#" . source</query>
  </search>
  <selectFirstChoice>true</selectFirstChoice>
  <fieldForLabel>dropdown_input</fieldForLabel>
  <fieldForValue>magic</fieldForValue>
  <change>
    <condition value="*">
      <eval token="index">mvindex(split($value$, "#c#e#r#b#y#"), 0, 0)</eval>
      <eval token="sourcetype">mvindex(split($value$, "#c#e#r#b#y#"), 1, 1)</eval>
      <eval token="source">mvindex(split($value$, "#c#e#r#b#y#"), 2, 2)</eval>
    </condition>
  </change>
</input>

The input itself can only set one token, so this sets a magic token containing several tokens that then get extracted into individual tokens.

View solution in original post

SplunkTrust
SplunkTrust

This should do:

<input type="dropdown" token="magic" searchWhenChanged="true">
  <label>Choose Service</label>
  <search>
    <query>| inputlookup cerby.csv | eval magic = index . "#c#e#r#b#y#" . sourcetype . "#c#e#r#b#y#" . source</query>
  </search>
  <selectFirstChoice>true</selectFirstChoice>
  <fieldForLabel>dropdown_input</fieldForLabel>
  <fieldForValue>magic</fieldForValue>
  <change>
    <condition value="*">
      <eval token="index">mvindex(split($value$, "#c#e#r#b#y#"), 0, 0)</eval>
      <eval token="sourcetype">mvindex(split($value$, "#c#e#r#b#y#"), 1, 1)</eval>
      <eval token="source">mvindex(split($value$, "#c#e#r#b#y#"), 2, 2)</eval>
    </condition>
  </change>
</input>

The input itself can only set one token, so this sets a magic token containing several tokens that then get extracted into individual tokens.

View solution in original post

Champion

Are JS extensions in splunkjs an option or are you required to only use Simple XML?

0 Karma

Contributor

Only Simple XML.

0 Karma