Splunk Search

Using token from previous populating search within a second populating search

Path Finder

Hi all,

I am currently using a populating search for several dropdowns in a dashboard. I have one for location, device name, time range etc. I am trying to set up the dashboard in such a way that the location selected will then be plugged into my other populating searches (device name for instance), so only devices for the given location will be showed as options in the dropdown. Is this possible?

Example:
Location

 <input type="dropdown" token="Location">
    <label>Location</label>
    <choice value="*">All Location</choice>
    <populatingSearch fieldForValue="aa" fieldForLabel="aa">
          <![CDATA[index=my_index sourcetype=syslog earliest=-60m |rex field=Location "All Locations\#(?<aa>\w+)" | stats count by aa]]>
    </populatingSearch>

Devices
(Populating search will show all devices regardless of location. I would like this to show only devices in the location I specify in the previous dropdown)

<input type="dropdown" token="Device">
    <label>Device</label>
    <choice value="*">All Devices</choice>
    <populatingSearch fieldForValue="DeviceName" fieldForLabel="DeviceName">
          <![CDATA[index=my_index sourcetype=syslog earliest=-60m | stats count by DeviceName]]>
    </populatingSearch>
</input>
0 Karma

SplunkTrust
SplunkTrust

Try this in dropdown xml for Device

<input type="dropdown" token="Device">
    <label>Device</label>
    <choice value="*">All Devices</choice>
    <populatingSearch fieldForValue="DeviceName" fieldForLabel="DeviceName">
          <![CDATA[index=my_index sourcetype=syslog earliest=-60m |rex field=Location "All Locations\#(?<aa>\w+)" | search aa="$Location$" | stats count by DeviceName ]]>
    </populatingSearch>
</input>
0 Karma

Path Finder

I am using 4.3.5 right now but hope to be on 6.1 soon which I am sure will probably resolve issues like this one!

0 Karma

SplunkTrust
SplunkTrust

What version of Splunk are you using?

0 Karma

Path Finder

It shows "All Devices" after page load and it remains that way after I have selected a location as well.

0 Karma

SplunkTrust
SplunkTrust

The dropdown should show "All Devices" only at page load. Does it show "All Devices" only event after selecting a Location?

0 Karma

Path Finder

Hmm, that doesn't seem to be working...now the dropdown only shows "All Devices". I think the problem is that the dropdowns all populate the moment the dashboard starts, how do I tell the Device to only populate once I have specified Location in the prior dropdown?

0 Karma