How to Add Dropdown Input option to Splunk Dashboard
The main purpose of adding inputs in Splunk dashboard is to make dashboards dynamic. There are few easy steps to add “Splunk Dashboard Input Dropdown” to the dashboard.
Step 1:
Open a dashboard which you want to make dynamic. You can see the Edit option on top right corner of the dashboard. Click on the Edit option.
Step 2:
After clicking Edit option you can see Add Input option in the dashboard , click on that. Then click on Dropdown.
Step 3:
Now edit the Dropdown option . There you have to give a Label, which will be shown on the dashboard. Then click the check box beside Search on Change . If you don’t click this then it will not effect the dashboard. So every time you have to click the check box. Give a Token name by which value will pass. Here we have a given a token name as dropdown_token .
There are two ways to put the values of the field. One is Static Options and another is Dynamic Options.
Step 4: Static Options
In the static options you have to add the names of values of a field as you want to see to the dashboard and against those names you have to specify the values manually. At last click on Apply button.
Step 5 :
You have to pass the token inside the panels which you want to make dependent upon the token. Click on Edit Search of that panel. Token name should be enclosed by “$” sign. Also you have to mention the field name for which token will work. Here we have given the field name as method. Click on the Apply button.
Step 6:
After making changes in the dashboard click on Save button to save all the changes and refresh the dashboard tab once.
Step 7:
Finally in Splunk Dashboard Dropdown Input option is added. Select any method name from the dropdown list . Depending upon the value dashboard will populate. Here we have selected “get” as a method field value.
Step 8: Dynamic Options
Follow the steps from 1 to 3 as it is. In the dynamic options, you have to enter a Search String from which we can get all the names of a particular field. Select the time as All time to get all the values of that field. Also, you have to give Field For Label for which field you want to populate the dropdown input option. You have to give the Field For Value for which field you want to populate the dropdown input option. For selecting all values of the method field we have given All in static options. Here don’t need to write all the options manually. The option values will be automatically generated by Search String. Click on Apply button.
Step 9:
You have to pass the token inside the panels which you want to make depends upon the token. Click on Edit Search of that panel. The token name should be enclosed by “$” sign. Also, you have to mention the field name for which token will work. Here we have given the field name as a method. Click on the Apply button.
Step 10:
After making changes in the dashboard click on the Save button to save all the changes and refresh the dashboard tab once.
Step 11:
Finally Splunk Dashboard Input Dropdown option is added in the dashboard. Select any method name from the dropdown list . Depending upon the value dashboard will populate. Here we have selected “DELETE” as a method field value.
Hope this has helped you in achieving the below requirement without fail:
How to Add Splunk Dashboard Input Dropdown option to Splunk Dashboard
Happy Splunking !!
[…] Now you have to edit the dropdown option. For editing dropdown option you can follow How to Add Dropdown Input option to Splunk Dashboard. […]
i have created one sourcetype dropdown but how that will show based on selected tokens??? can u help me on that
I would appreciate if you kindly go through the Step 9 of this particular blog post
host 3
aindex 1
asource 1
asourcetype 3
INTERESTING FIELDS
#date_hour 24
#date_mday 2
#date_minute 60
adate_month 1
#date_second 60
adate_wday 2
#date_year 1
adate_zone 1
#linecount 1
asplunk_server 1
#timeendpos 11
#timestartpos 8
only these fields are available ..so how i can select based on dropdown
I have to understand your question first . lets crawl slowly . You have a dropdown. Now, what is shown in the dropdown and what you want to show more ?
based on that selection i want to show token data…what i have to write in search string?
in step 11..u have selected delete option and in pie chart u get delete info, like that i have dropdown which name is sourcetype . so,based on that selection how that will show the result in any chart.
Panel will have the chart visualization and Chart visualization will have a query written behind. In that query you need to use the same token which you are using in the “DROPDOWN”. Ex:- the token name is “AA” then you need to use this in your query like :- index=indexname sourcetype=sourcetypename “$AA$” ( Now the placement of the $AA$ token depends on what your query wants to output )
Dear Itishree,
This was my question “Now, what is shown in the dropdown and what you want to show more ?” and you answered something. You need to clearly explain me upon clicking on the dropdown what is showing and upon doing the selection what you want to show ?
we need to get a dashboard created with basic security information.Based on selection of sourcetype data should load with relevant columns.
Thank you for posting in such simple steps. I am very new to splunk and it was a breeze to create drop downs because of your post
Hi , I have two values for the above example head = HEAD1 and HEAD2 how to use it