How to apply the output of query to the values of dropdown

[bollam]

Hello,

I have got a dashboard with more than one dropdown's in it. But I need to create a dropdown with following options.

default
countgt10
countgt20
countgt50
countgt100

<input type="dropdown" token="select_count">
  <label>select_path_aggregation</label>
  <choice value=>countgt10</choice>
  <choice value=>countgt20</choice>
  <choice value=>countgt50</choice>
  <choice value=>countgt100</choice>
</input>

I have got a query index=main source=/opt/test/log/test.log | stats count by product

If the query returns the count > 10 then results need to sent to the value of countgt10, if the count is greater than 20, it needs to be sent to the values of countgt20 and similarly to the other options.

[niketn]

@bollam please add more details to your use case. Since you have | stats count by product in your search you will have multiple rows. Hence there may be rows falling under different categories. Do you want to populate Dropdown based on which Product Row is clicked? Also what is the visualization for your stats search query? Is it table or chart? What do you mean by count > 10 results need to sent to the value of countgt10? Can you give an example with some dummy Product Names and Counts?

Count>20 means Count>10 is also true, what would you do under such situation? Rather than code, if you explained your issue with Sample Data and expected behavior, it would help us assist you better.

[YoungDaniel]

Hi Bollam,

I would either use an eval within my search to set the countgtxx fields. You could use a case statement looking like this.

| eval countgt20 = if ( count > 20 , count, ""), countgt10= if (count > 20 , count, "" ) ...

And then use the value of countgt20/10 to populate your dropdown values,

The other way is to use the <condition> </condition> statement along with an eval in the simplexml. This way you can assign values to your different tokens used in the dashboard.
http://docs.splunk.com/Documentation/Splunk/7.1.2/Viz/PanelreferenceforSimplifiedXML#condition_.28fo...

[bollam]

@YoungDanieI, Have tried this but i could not see the results of defaultt is not listing down under default.
When I select default from the dropdown the results of defaultt from the query need to be displayed.
Can you please help on this?

    <input type="dropdown" token="select_path_aggregation">
      <search>
        <query>
          index=main host=$server$
| eval delimiter = direct
| eval count = split(direct ,"/"), count = mvcount(count)
| where count = 4
    | stats values(delimiter) as defaultt by server
        </query>
      </search>
      <label>select_path_aggregation</label>
      <choice value="$defaultt$">default</choice>
      <choice>4th level</choice>
      <choice>5th level</choice>
      <choice>more than 6th level</choice>
    </input>