Dashboards & Visualizations

How to achieve cascading dynamic drop downs with CSV data?

ramana4u
Explorer

Dear Community,

How do I display values from second dropdown values based on first dropdown value.

 

<input type="dropdown" token="site" searchWhenChanged="true">

| inputlookup regions_instances.csv | fields region region_value

 

<input type="dropdown" token="instance" searchWhenChanged="true">

| inputlookup regions_instances.csv | search region=$site$ | fields  instance instance_value

 

 

Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ramana4u,

the approach you followed is correct, what's your issue or doubt?

Ciao.

Giuseppe

0 Karma

ramana4u
Explorer

Image1.PNG

 

Thanks for looking into this.

First dropdown is ok.   No values shown in the second dropdown.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ramana4u,

you should check if the fields in the second lookup is the same of the first and that the value from the first is present in teh second.

Then you don't need to use where, you could use where in the inputlookup command, but thisisn't the issue.

| inputlookup regions_instances.csv WHERE region=$site$ 
| fields instance instance_value

could you share the full code on both inputs?

Are you using Dashboard Classic or Dashboard Studio?

Ciao.

Giuseppe

0 Karma

ramana4u
Explorer

Hi @gcusello 

// Here the full code

<fieldset submitButton="false">
<input type="dropdown" token="dccsite" searchWhenChanged="true">
<label>Choose Site</label>
<fieldForLabel>region</fieldForLabel>
<fieldForValue>region_value</fieldForValue>
<search>
<query>| inputlookup regions_instances.csv | fields region region_value | dedup region  region_value</query>
</search>
<default>express:dcceu:applog</default>
<initialValue>express:dcceu:applog</initialValue>
</input>
<input type="dropdown" token="dccinstance" searchWhenChanged="true">
<label>Choose Instance</label>
<fieldForLabel>instance</fieldForLabel>
<fieldForValue>instance_value</fieldForValue>
<search>
<query>|inputlookup regions_instances.csv | WHERE region=$dccsite$ | fields region region_value instance instance_value</query>
</search>
<default>/appl/dcc/dcceuexp/applogs/*</default>
<initialValue>/appl/dcc/dcceuexp/applogs/*</initialValue>
</input>
</fieldset>

//  regions_instances.csv

region,region_value,instance,instance_value
APEM,express:dcc:applog,Import,/appl/dcc/dccadm/applogs/*
APEM,express:dcc:applog,Export,/appl/dcc/dccexp/applogs/*
EU,express:dcceu:applog,Import,/appl/dcc/dcceu/applogs/*
EU,express:dcceu:applog,Export,/appl/dcc/dcceuexp/applogs/*
Trans,express:dcc:applog*,Import,/appl/dcc/dcceu/dcc2/applogs/*
Trans,express:dcc:applog*,Export,/appl/dcc/dcceuexp/dcc2/applogs/*
US,*express:dcc:applog,Import,/appl/dcc/dccus/applogs/*
US,*express:dcc:applog,Export,/appl/dcc/dccusexp/applogs/*

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ramana4u,

at first try to add quotes to the second input search:

| inputlookup regions_instances.csv | WHERE region="$dccsite$"

then please check if there a mistake between region and region_value maybe you have to use for the filter in the second input again region_value.

If it doesn'ìt run again try to add some asterisk at the beginning and the end of the condition.

| inputlookup regions_instances.csv | WHERE region="*$dccsite$*"

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...