Using token from previous populating search within a second populating search

[bcarr12]

Hi all,

I am currently using a populating search for several dropdowns in a dashboard. I have one for location, device name, time range etc. I am trying to set up the dashboard in such a way that the location selected will then be plugged into my other populating searches (device name for instance), so only devices for the given location will be showed as options in the dropdown. Is this possible?

Example:
Location

 <input type="dropdown" token="Location">
    <label>Location</label>
    <choice value="*">All Location</choice>
    <populatingSearch fieldForValue="aa" fieldForLabel="aa">
          <![CDATA[index=my_index sourcetype=syslog earliest=-60m |rex field=Location "All Locations\#(?<aa>\w+)" | stats count by aa]]>
    </populatingSearch>

Devices
(Populating search will show all devices regardless of location. I would like this to show only devices in the location I specify in the previous dropdown)

<input type="dropdown" token="Device">
    <label>Device</label>
    <choice value="*">All Devices</choice>
    <populatingSearch fieldForValue="DeviceName" fieldForLabel="DeviceName">
          <![CDATA[index=my_index sourcetype=syslog earliest=-60m | stats count by DeviceName]]>
    </populatingSearch>
</input>

[somesoni2]

Try this in dropdown xml for Device

<input type="dropdown" token="Device">
    <label>Device</label>
    <choice value="*">All Devices</choice>
    <populatingSearch fieldForValue="DeviceName" fieldForLabel="DeviceName">
          <![CDATA[index=my_index sourcetype=syslog earliest=-60m |rex field=Location "All Locations\#(?<aa>\w+)" | search aa="$Location$" | stats count by DeviceName ]]>
    </populatingSearch>
</input>

[bcarr12]

I am using 4.3.5 right now but hope to be on 6.1 soon which I am sure will probably resolve issues like this one!

[somesoni2]

What version of Splunk are you using?

[bcarr12]

It shows "All Devices" after page load and it remains that way after I have selected a location as well.

[somesoni2]

The dropdown should show "All Devices" only at page load. Does it show "All Devices" only event after selecting a Location?

[bcarr12]

Hmm, that doesn't seem to be working...now the dropdown only shows "All Devices". I think the problem is that the dropdowns all populate the moment the dashboard starts, how do I tell the Device to only populate once I have specified Location in the prior dropdown?