Dashboards & Visualizations

How to dynamically fill in a dropdown?

matoulas
Path Finder

Hi all,
We have some custom JSON data getting into Splunk. We're also creating some dashboard with this data. Everything is working great, except for the dynamic drop down.

In our data, (below), we have JSON coming from two different devices, one has a powerdata of branch1 and another has a powerdata of branch1 and branch2.

What I would like to do is to show or display all selections to the maximum reading like (1,2,34,5,6,7,8 and so on) in powerdata for each branch current in the dropdown.

FYI, look similar to the below link, but I would like to rad the data from powerdata for each branch instead of from the plugcount.
https://answers.splunk.com/answers/748424/how-to-dynamically-fill-in-a-dropdown.html#answer-748429

Looking forward to your help.

Here is the JSON sent to Splunk

{   [-] 
     assettag:   VMR-8HS20-2    
     ats:    0  
     branchcount:    1  
     outletmetering:     1  
     plugcount:  8  
     powerdata: [   [-] 
        {   [-] 
         branch1:   [   [-] 
            {   [-] 
             current1:   1.90   
             voltage1:   120.00 
            }   
        ]   
         format:     F  
         temperature:    81 
         timestamp:  2019-06-19T15:16:10+00:00  
        }   
    ]   
     powerdatacount:     1  
     powereff:   100    
     powerfactor:    100    
     powerunit:  1  
     siteid:     LABRACK1   
     timestamp:  2019-06-19T15:16:10+00:00  
}

Here is another JSON sent to Splunk

{   [-] 
     assettag:   CPM-1600-1-ECAM-LAB    
     ats:    1  
     branchcount:    2  
     outletmetering:     1  
     plugcount:  16 
     powerdata: [   [-] 
        {   [-] 
         branch1:   [   [-] 
            {   [-] 
             current1:   0.00   
             current2:   0.20   
             current3:   0.40   
             current4:   0.00   
             current5:   0.00   
             current6:   0.00   
             current7:   0.00   
             current8:   0.00   
             voltage1:   116.00 
            }   
        ]   
         branch2:   [   [-] 
            {   [-] 
             current1:   0.00   
             current2:   0.00   
             current3:   0.00   
             current4:   0.00   
             current5:   0.00   
             current6:   0.00   
             current7:   0.00   
             current8:   0.00   
             voltage1:   114.00 
            }   
        ]   
         timestamp:  2019-06-19T15:33:53+00:00  
        }   
    ]   
     powerdatacount:     1  
     powereff:   100    
     powerfactor:    100    
     powerunit:  1  
     siteid:     LABRACK1   
     timestamp:  2019-06-19T15:33:53+00:00  
}
0 Karma

matoulas
Path Finder

Below is the main search query

index="main" | table sourcetype, siteid, assettag, ats, outletmetering, powerunit, branchcount, plugcount, powerdata{}.branch1{}.current1, powerdata{}.branch1{}.current2, powerdata{}.branch1{}.current3, powerdata{}.branch1{}.current4, powerdata{}.branch1{}.current5, powerdata{}.branch1{}.current6, powerdata{}.branch1{}.current7, powerdata{}.branch1{}.current8, powerdata{}.branch1{}.voltage1, powerdata{}.branch2{}.current1, powerdata{}.branch2{}.current2, powerdata{}.branch2{}.current3, powerdata{}.branch2{}.current4, powerdata{}.branch2{}.current5, powerdata{}.branch2{}.current6, powerdata{}.branch2{}.current7, powerdata{}.branch2{}.current8, powerdata{}.branch2{}.voltage1, timestamp, _time | eval Date/Time=_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Date/Time) | eval timestamp=strptime(timestamp, "%Y-%m-%dT%H:%M:%S")| eval timestamp=strftime(timestamp,"%m-%d-%Y %H:%M:%S") | eval release_year = strftime(timestamp_epoc, "%Y") | fillnull value="No Defined" release_year, ats, outletmetering, powerunit, branchcount, plugcount, powerdata{}.branch1{}.current1, powerdata{}.branch1{}.current2, powerdata{}.branch1{}.current3, powerdata{}.branch1{}.current4, powerdata{}.branch1{}.current5, powerdata{}.branch1{}.current6, powerdata{}.branch1{}.current7, powerdata{}.branch1{}.current8, powerdata{}.branch1{}.voltage1, powerdata{}.branch2{}.current1, powerdata{}.branch2{}.current2, powerdata{}.branch2{}.current3, powerdata{}.branch2{}.current4, powerdata{}.branch2{}.current5, powerdata{}.branch2{}.current6, powerdata{}.branch2{}.current7, powerdata{}.branch2{}.current8, powerdata{}.branch2{}.voltage1 | search sourcetype=powerdata

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...