I am populating Splunk dashboard input ItemCategory
based on Dashboard style
dropdown token, currently using <eval token="form.ItemCategory">split("CAT","CAT2","CAT3",",")</eval>
to auto-populate multi-select input however user is restricted to specific items (as per eval definiton) and cannot deselect ItemCategory
items (ex. should be able to deselect CAT2
) as eval is refreshed with user click.
Having non-standard panels that are specific to Dashboard style
dropdown token and would like to limit ItemCategory
multi-select dropdown so charts are working as expected (as some group of categories are having different format of data) but to leave some flexibility for a user.
Expected result
With Dashboard style
dropdown input of Style1
limit or auto-populate ItemCategory
multi-select input to CAT CAT2 CAT3
but user should be able to pick/manipulate (or drilldown to one) any of CAT
CAT2
CAT3
from ItemCategory
With Dashboard style
dropdown input of Style2
limit or auto-populate ItemCategory
multi-select input to CAT4 CAT5 CAT6
but user should be able to pick/manipulate (or drilldown to one) any of CAT4
CAT5
CAT6
from ItemCategory
Current Splunk dashboard definition
<dashboard version="1.1">
<label>Dashboard</label>
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="style" searchWhenChanged="true" id="style_input">
<label>Dashboard style</label>
<choice value="*">Default</choice>
<choice value="style1">Style1</choice>
<choice value="style2">Style2</choice>
<default>*</default>
<initialValue>*</initialValue>
<change>
<condition label="Default">
<unset token="style1"></unset>
<unset token="style2"></unset>
</condition>
<condition label="Style1">
<set token="style1">true</set>
<eval token="form.ItemCategory">split("CAT","CAT2","CAT3",",")</eval>
</condition>
<condition label="Style2">
<set token="style2">true</set>
<eval token="form.ItemCategory">split("CAT4","CAT5","CAT6",",")</eval>
</condition>
</change>
<fieldForLabel>dashboard_style</fieldForLabel>
<fieldForValue>dashboard_style</fieldForValue>
<search base="baseSearch"></search>
<input type="multiselect" token="ItemCategory" searchWhenChanged="true" id="ItemCategory_input">
<label>ItemCategory</label>
<choice value="*">All</choice>
<fieldForLabel>itemCategory</fieldForLabel>
<fieldForValue>itemCategory</fieldForValue>
<default>*</default>
<search base="baseSearch">
<query>| stats count by itemCategory</query>
</search>
<prefix>(</prefix>
<valuePrefix>itemCategory="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
</input>
</fieldset>
<row>
<panel>
<title>Count by ItemCategory</title>
<chart>
<search base="baseSearch">
<query>| stats count by itemCategory</query>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">all</option>
<drilldown>
<set token="ItemCategory">$click.value$</set>
<set token="form.ItemCategory">$click.value$</set>
</drilldown>
</chart>
</panel>
<panel depends="$style1$">
[...]
</panel>
<panel depends="$style2$">
[...]
</panel>
</row>
<row>
<panel>
<title>Results</title>
<table>
<search id="baseSearch">
<query>| inputlookup lookup.csv.gz | search $ItemCategory$ | table hostname itemCategory</query>
</search>
</table>
</panel>
</row>
</dashboard>