Dashboards & Visualizations

search result as field for filtering in visualization

totaro
Explorer

Hi
i have a statistic table in one of my dashboard that show the result of a search. Is it possible to use some of those fields as filter without re-running the search?

e.g.
Table:

Date Field     Field1
04/22              A
04/18              B
04/11              C

As the date field is dynamic and is the result of the search, is it possible to use those as a field as dashboard input to show Field1 only from a specific date.

Tags (3)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Check this sample and use base search

<form>
  <label>filter</label>
  <search id="base_query">
    <query>index="_internal"  |table source,host,sourcetype,splunk_server</query>
    <earliest>$timepicker.earliest$</earliest>
    <latest>$timepicker.latest$</latest>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="timepicker">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="host">
      <label>host</label>
      <search base="base_query">
        <query>|stats count by host</query>
      </search>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <prefix>host="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search base="base_query">
          <query>
           |search $host$ |stats count by source
          </query>
        </search>
      </table>
    </panel>
  </row>
</form>

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Check this sample and use base search

<form>
  <label>filter</label>
  <search id="base_query">
    <query>index="_internal"  |table source,host,sourcetype,splunk_server</query>
    <earliest>$timepicker.earliest$</earliest>
    <latest>$timepicker.latest$</latest>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="timepicker">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="host">
      <label>host</label>
      <search base="base_query">
        <query>|stats count by host</query>
      </search>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <prefix>host="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search base="base_query">
          <query>
           |search $host$ |stats count by source
          </query>
        </search>
      </table>
    </panel>
  </row>
</form>
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi totaro,
let me understand. do you want to display Field1 values with Date fiels greather than the clicked value clicking e.g. on 04/18 and without re run the search?
You could do this passing the clicked field value as a token to another search to run in a different panel of the same dashboard or to another dashboard, in this way you have to re-run the same search but limited by the clicked value.
You can find how to pass a token to another panel of the same dashboard in the Dashboard Examples App (see https://splunkbase.splunk.com/app/1603/).

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...