Dashboards & Visualizations

How to dynamically fill in a dropdown?

matoulas
Path Finder

Hi all,
We have some custom JSON data getting into Splunk. We're also creating some dashboard with this data. Everything is working great, except for the dynamic drop down.

In our data, (below), we have JSON coming from two different devices, one has a powerdata of branch1 and another has a powerdata of branch1 and branch2.

What I would like to do is to show or display all selections to the maximum reading like (1,2,34,5,6,7,8 and so on) in powerdata for each branch current in the dropdown.

FYI, look similar to the below link, but I would like to rad the data from powerdata for each branch instead of from the plugcount.
https://answers.splunk.com/answers/748424/how-to-dynamically-fill-in-a-dropdown.html#answer-748429

Looking forward to your help.

Here is the JSON sent to Splunk

{   [-] 
     assettag:   VMR-8HS20-2    
     ats:    0  
     branchcount:    1  
     outletmetering:     1  
     plugcount:  8  
     powerdata: [   [-] 
        {   [-] 
         branch1:   [   [-] 
            {   [-] 
             current1:   1.90   
             voltage1:   120.00 
            }   
        ]   
         format:     F  
         temperature:    81 
         timestamp:  2019-06-19T15:16:10+00:00  
        }   
    ]   
     powerdatacount:     1  
     powereff:   100    
     powerfactor:    100    
     powerunit:  1  
     siteid:     LABRACK1   
     timestamp:  2019-06-19T15:16:10+00:00  
}

Here is another JSON sent to Splunk

{   [-] 
     assettag:   CPM-1600-1-ECAM-LAB    
     ats:    1  
     branchcount:    2  
     outletmetering:     1  
     plugcount:  16 
     powerdata: [   [-] 
        {   [-] 
         branch1:   [   [-] 
            {   [-] 
             current1:   0.00   
             current2:   0.20   
             current3:   0.40   
             current4:   0.00   
             current5:   0.00   
             current6:   0.00   
             current7:   0.00   
             current8:   0.00   
             voltage1:   116.00 
            }   
        ]   
         branch2:   [   [-] 
            {   [-] 
             current1:   0.00   
             current2:   0.00   
             current3:   0.00   
             current4:   0.00   
             current5:   0.00   
             current6:   0.00   
             current7:   0.00   
             current8:   0.00   
             voltage1:   114.00 
            }   
        ]   
         timestamp:  2019-06-19T15:33:53+00:00  
        }   
    ]   
     powerdatacount:     1  
     powereff:   100    
     powerfactor:    100    
     powerunit:  1  
     siteid:     LABRACK1   
     timestamp:  2019-06-19T15:33:53+00:00  
}
0 Karma

matoulas
Path Finder

Below is the main search query

index="main" | table sourcetype, siteid, assettag, ats, outletmetering, powerunit, branchcount, plugcount, powerdata{}.branch1{}.current1, powerdata{}.branch1{}.current2, powerdata{}.branch1{}.current3, powerdata{}.branch1{}.current4, powerdata{}.branch1{}.current5, powerdata{}.branch1{}.current6, powerdata{}.branch1{}.current7, powerdata{}.branch1{}.current8, powerdata{}.branch1{}.voltage1, powerdata{}.branch2{}.current1, powerdata{}.branch2{}.current2, powerdata{}.branch2{}.current3, powerdata{}.branch2{}.current4, powerdata{}.branch2{}.current5, powerdata{}.branch2{}.current6, powerdata{}.branch2{}.current7, powerdata{}.branch2{}.current8, powerdata{}.branch2{}.voltage1, timestamp, _time | eval Date/Time=_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Date/Time) | eval timestamp=strptime(timestamp, "%Y-%m-%dT%H:%M:%S")| eval timestamp=strftime(timestamp,"%m-%d-%Y %H:%M:%S") | eval release_year = strftime(timestamp_epoc, "%Y") | fillnull value="No Defined" release_year, ats, outletmetering, powerunit, branchcount, plugcount, powerdata{}.branch1{}.current1, powerdata{}.branch1{}.current2, powerdata{}.branch1{}.current3, powerdata{}.branch1{}.current4, powerdata{}.branch1{}.current5, powerdata{}.branch1{}.current6, powerdata{}.branch1{}.current7, powerdata{}.branch1{}.current8, powerdata{}.branch1{}.voltage1, powerdata{}.branch2{}.current1, powerdata{}.branch2{}.current2, powerdata{}.branch2{}.current3, powerdata{}.branch2{}.current4, powerdata{}.branch2{}.current5, powerdata{}.branch2{}.current6, powerdata{}.branch2{}.current7, powerdata{}.branch2{}.current8, powerdata{}.branch2{}.voltage1 | search sourcetype=powerdata

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...