Splunk Search

What is the easiest way to create an input filter for a dynamic Drop-down Splunk 6.1.3?

dwalker1
New Member

Hi Folks,

I have a dashboard that automatically populates a drop-down based on a search with CDATA. I want to be able to actually type into the box, say a specific IP, and as I'm typing it, have it do an on-demand filter. The closest I've been able to do is a "multi-select" input instead of a drop-down. Does anyone know the easiest way to do this?

Thanks!

0 Karma

ngatchasandra
Builder

Hi,
In Splunk 6.2, this is possible . When you type for example a specific sourcetype in my case, the input will automatically filter the sourcetype who macth to that sourcetype. My XML code with CDATA! is:

<form>
  <label>Dashboard_Filter</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="sourcetype" searchWhenChanged="true">
      <label>Select Sourcetype</label>
      <search>
        <query><![CDATA[index=_internal | table sourcetype]]></query>
      </search>
      <fieldForLabel>sourectype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <prefix>sourcetype="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | stats count by sourcetype</query>
          <earliest></earliest>
          <latest></latest>
        </search>
      </table>
    </panel>
  </row>
</form>
0 Karma

somesoni2
SplunkTrust
SplunkTrust

For Splunk 6.1.X version, multiselect is option to get the dropdown with text field. This feature is available (brought back) in Splunk 6.2

0 Karma

dwalker1
New Member

Would you be able to only have it default to one selection?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...