Dashboards & Visualizations

How to dynamically fill in a dropdown?

matoulas
Path Finder

Hi all,
We have some custom JSON data getting into Splunk. We're also creating some dashboard with this data. Everything is working great, except for the dynamic drop down.

In our data, (below), we have JSON coming from two different devices, one has a powerdata of branch1 and another has a powerdata of branch1 and branch2.

What I would like to do is to show or display all selections to the maximum reading like (1,2,34,5,6,7,8 and so on) in powerdata for each branch current in the dropdown.

FYI, look similar to the below link, but I would like to rad the data from powerdata for each branch instead of from the plugcount.
https://answers.splunk.com/answers/748424/how-to-dynamically-fill-in-a-dropdown.html#answer-748429

Looking forward to your help.

Here is the JSON sent to Splunk

{   [-] 
     assettag:   VMR-8HS20-2    
     ats:    0  
     branchcount:    1  
     outletmetering:     1  
     plugcount:  8  
     powerdata: [   [-] 
        {   [-] 
         branch1:   [   [-] 
            {   [-] 
             current1:   1.90   
             voltage1:   120.00 
            }   
        ]   
         format:     F  
         temperature:    81 
         timestamp:  2019-06-19T15:16:10+00:00  
        }   
    ]   
     powerdatacount:     1  
     powereff:   100    
     powerfactor:    100    
     powerunit:  1  
     siteid:     LABRACK1   
     timestamp:  2019-06-19T15:16:10+00:00  
}

Here is another JSON sent to Splunk

{   [-] 
     assettag:   CPM-1600-1-ECAM-LAB    
     ats:    1  
     branchcount:    2  
     outletmetering:     1  
     plugcount:  16 
     powerdata: [   [-] 
        {   [-] 
         branch1:   [   [-] 
            {   [-] 
             current1:   0.00   
             current2:   0.20   
             current3:   0.40   
             current4:   0.00   
             current5:   0.00   
             current6:   0.00   
             current7:   0.00   
             current8:   0.00   
             voltage1:   116.00 
            }   
        ]   
         branch2:   [   [-] 
            {   [-] 
             current1:   0.00   
             current2:   0.00   
             current3:   0.00   
             current4:   0.00   
             current5:   0.00   
             current6:   0.00   
             current7:   0.00   
             current8:   0.00   
             voltage1:   114.00 
            }   
        ]   
         timestamp:  2019-06-19T15:33:53+00:00  
        }   
    ]   
     powerdatacount:     1  
     powereff:   100    
     powerfactor:    100    
     powerunit:  1  
     siteid:     LABRACK1   
     timestamp:  2019-06-19T15:33:53+00:00  
}
0 Karma

matoulas
Path Finder

Below is the main search query

index="main" | table sourcetype, siteid, assettag, ats, outletmetering, powerunit, branchcount, plugcount, powerdata{}.branch1{}.current1, powerdata{}.branch1{}.current2, powerdata{}.branch1{}.current3, powerdata{}.branch1{}.current4, powerdata{}.branch1{}.current5, powerdata{}.branch1{}.current6, powerdata{}.branch1{}.current7, powerdata{}.branch1{}.current8, powerdata{}.branch1{}.voltage1, powerdata{}.branch2{}.current1, powerdata{}.branch2{}.current2, powerdata{}.branch2{}.current3, powerdata{}.branch2{}.current4, powerdata{}.branch2{}.current5, powerdata{}.branch2{}.current6, powerdata{}.branch2{}.current7, powerdata{}.branch2{}.current8, powerdata{}.branch2{}.voltage1, timestamp, _time | eval Date/Time=_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Date/Time) | eval timestamp=strptime(timestamp, "%Y-%m-%dT%H:%M:%S")| eval timestamp=strftime(timestamp,"%m-%d-%Y %H:%M:%S") | eval release_year = strftime(timestamp_epoc, "%Y") | fillnull value="No Defined" release_year, ats, outletmetering, powerunit, branchcount, plugcount, powerdata{}.branch1{}.current1, powerdata{}.branch1{}.current2, powerdata{}.branch1{}.current3, powerdata{}.branch1{}.current4, powerdata{}.branch1{}.current5, powerdata{}.branch1{}.current6, powerdata{}.branch1{}.current7, powerdata{}.branch1{}.current8, powerdata{}.branch1{}.voltage1, powerdata{}.branch2{}.current1, powerdata{}.branch2{}.current2, powerdata{}.branch2{}.current3, powerdata{}.branch2{}.current4, powerdata{}.branch2{}.current5, powerdata{}.branch2{}.current6, powerdata{}.branch2{}.current7, powerdata{}.branch2{}.current8, powerdata{}.branch2{}.voltage1 | search sourcetype=powerdata

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...