Splunk dashboard limit multiselect input based on token

87 views Asked by At

I am populating Splunk dashboard input ItemCategory based on Dashboard style dropdown token, currently using <eval token="form.ItemCategory">split("CAT","CAT2","CAT3",",")</eval> to auto-populate multi-select input however user is restricted to specific items (as per eval definiton) and cannot deselect ItemCategory items (ex. should be able to deselect CAT2) as eval is refreshed with user click.

Having non-standard panels that are specific to Dashboard style dropdown token and would like to limit ItemCategory multi-select dropdown so charts are working as expected (as some group of categories are having different format of data) but to leave some flexibility for a user.

Expected result

With Dashboard style dropdown input of Style1 limit or auto-populate ItemCategory multi-select input to CAT CAT2 CAT3 but user should be able to pick/manipulate (or drilldown to one) any of CAT CAT2 CAT3 from ItemCategory

With Dashboard style dropdown input of Style2 limit or auto-populate ItemCategory multi-select input to CAT4 CAT5 CAT6 but user should be able to pick/manipulate (or drilldown to one) any of CAT4 CAT5 CAT6 from ItemCategory

Current Splunk dashboard definition

 <dashboard version="1.1">
    <label>Dashboard</label>
    <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="style" searchWhenChanged="true" id="style_input">
        <label>Dashboard style</label>
        <choice value="*">Default</choice>
        <choice value="style1">Style1</choice>
        <choice value="style2">Style2</choice>
        <default>*</default>
        <initialValue>*</initialValue>
        <change>
            <condition label="Default">
                <unset token="style1"></unset>
                <unset token="style2"></unset>
            </condition>
            <condition label="Style1">
                <set token="style1">true</set>
                <eval token="form.ItemCategory">split("CAT","CAT2","CAT3",",")</eval>
            </condition>
            <condition label="Style2">
                <set token="style2">true</set>
                <eval token="form.ItemCategory">split("CAT4","CAT5","CAT6",",")</eval>
            </condition>
        </change>
        <fieldForLabel>dashboard_style</fieldForLabel>
        <fieldForValue>dashboard_style</fieldForValue>
        <search base="baseSearch"></search>
    <input type="multiselect" token="ItemCategory" searchWhenChanged="true" id="ItemCategory_input">
        <label>ItemCategory</label>
        <choice value="*">All</choice>
        <fieldForLabel>itemCategory</fieldForLabel>
        <fieldForValue>itemCategory</fieldForValue>
        <default>*</default>
        <search base="baseSearch">
            <query>| stats count by itemCategory</query>
        </search>
        <prefix>(</prefix>
        <valuePrefix>itemCategory="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <delimiter> OR </delimiter>
        <suffix>)</suffix>
    </input>
    </fieldset>
    <row>
        <panel>
            <title>Count by ItemCategory</title>
            <chart>
                <search base="baseSearch">
                    <query>| stats count by itemCategory</query>
                </search>
                <option name="charting.chart">pie</option>
                <option name="charting.drilldown">all</option>
                <drilldown>
                    <set token="ItemCategory">$click.value$</set>
                    <set token="form.ItemCategory">$click.value$</set>
                </drilldown>
            </chart>
        </panel>
        <panel depends="$style1$">
        [...]
        </panel>
        <panel depends="$style2$">
        [...]
        </panel>
    </row>
    <row>
        <panel>
            <title>Results</title>
            <table>
                <search id="baseSearch">
                    <query>| inputlookup lookup.csv.gz | search $ItemCategory$ | table hostname itemCategory</query>
                </search>
            </table>
        </panel>
    </row>
</dashboard>
0

There are 0 answers