@ITWhisperer  Actually I need to have Time Input along with State and City Drop Down. Currently the SPL_query query is running for the static time period. Now I need to run for the chosen date and time range based on the "Time Input"   Please share me the completed XML where I need to add the time related XML. I also tried to change the time range in the query panel search button by selecting the "Time Range" from "Global" to "Shared Time Picker" but it didnt work. ... View more

@ITWhisperer  One Last question, please Currently I am running the SPL_Query with the static date, I have added "Time" from the "Add Input", how I will pass this date and time range to the SPL_Query.   ... View more

Super 🙂 Great, it works as expected ! Thank you very , much !! ... View more

Sure,  Please find below <form version="1.1"> <label>City Dashboard</label> <fieldset submitButton="false"> <input type="dropdown" token="state_filter"> <label>Select State</label> <fieldForLabel>State</fieldForLabel> <fieldForValue>State</fieldForValue> <search> <query> |inputlookup lookupfile.csv</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="city_filter"> <label>Select City</label> <fieldForLabel>City</fieldForLabel> <fieldForValue>SPL_Query</fieldForValue> <search> <query> |inputlookup lookupfile.csv | search State="$state_filter$"</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> </input> </fieldset> <row> <panel> <table> <title></title> <search> <query>$SPL_Query$</query> </search> </table> </panel> </row> </form>   ... View more

Sorry, I am very new to Splunk. It would be really helpful if you share me the XML or steps like you provided before, please. ... View more

Thanks @ITWhisperer  Your solution works! Great!! Actually my full requirement is like below State City SPL_Query State1 City1 SPL_Qry_for_City1 State1 City2 SPL_Qry_for_City2 State2 City3 SPL_Qry_for_City3 State2 City4 SPL_Qry_for_City4 State2 City5 SPL_Qry_for_City5 State3 City6 SPL_Qry_for_City6   1. If I select, State1 from the first Dropdown only City1 and City2 should be selected in the second dropdown. I have achieve it. 2. When I am selecting any City from the second drop down, only the related query should run and will give a result. Based on your suggestion, I have achieve it.   Now the issue what I am facing is, when I try to change the first dropdown, say from State1 to State2, now in my second Dropdown it is showing the previously selected Cities query (the raw query is showing in dropdown2).   How can I clear the value in Dropdown2 (City) each time when I am changing the  the value from Dropdown1 (State).   Please advise ... View more

@ITWhisperer  I tried the below <input type="dropdown" token="lookupquery"> <label>Select query</label> <fieldForLabel>Column 1</fieldForLabel> <fieldForValue>SPL_Query</fieldForValue> <search> <query>| inputlookup LookupFile.csv | search column1="$col1_token$"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> Then , as you mentioned, done with setting up panel <row> <panel> <table> <title></title> <search> <query>$SPL_Query$</query> </search> </table> </panel> </row>   New panel has been created, after choosing the dropdown the panel showing "Search is waiting for input". How can I run the query after choosing the value from dropdown? Also I verified the the newly created panel query by clicking the search icon, it contain the $SPL_Query$. Is this expected? Please advise   ... View more

Thanks for your reply @ITWhisperer, Yes, I am using  lookup file and using the inputlookup command to get the SPL_Query for the particular value. But the SPL which I am getting just display the whole query (raw query), its not running or showing the value for that particular SPL.   I have used the below SPL | inputlookup LookupFile.csv | search Column="$Col1_token$" | search SPL_Query   Kindly advise me with the Splunk Query to execute the SPl and get the result. ... View more