Splunk® Enterprise

Splunk Dashboard Studio

Splunk Enterprise version 9.0 will no longer be supported as of June 14, 2024. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Part 8 Add an input

Buttercup Games sells many different games, and on the dashboard, it's difficult to scan through all the games to find the one you're looking for. In this part of the tutorial, add a drop-down menu input to your dashboard to filter the visualizations by any game you choose. After you add an input, you must define the input token name and apply it to data sources powering the visualizations you want to filter.

  1. Select the add input icon (Three horizontal sliding toggles as an icon.) in the editing toolbar, and then select Dropdown.
    1. For Dashboard Studio in Splunk Enterprise versions 8.3.1 and earlier, skip to step 3.
  2. In the Configuration panel, give your input the following title and token name.
    1. Title: Select Game Category
    2. Token name: category
  3. In the Menu Configuration section, remove (An X.) the default rows so that there is only one value in the table: Static menu configuration with two columns: Label and Value. Beneath Label is the word "All" and beneath Value is an asterisk.
  4. In the Data Configurations section, select + Set up Primary Data Source.
  5. Select + Create Search and name it Games Categories.
  6. Add your search. For this tutorial, copy and paste the following search into the Search with SPL box:
    index=main sourcetype=access_* action=purchase status=200 
    | stats count by categoryId
    
  7. Expand the Code section and change the Data Source ID to ds_category.
  8. Select Apply & Close.
    1. For Dashboard Studio in Splunk Enterprise versions 8.3.1 and earlier, add the following to your input via source editor.
    "dataSources": {
    "primary": "ds_games"
    }
    
  9. Select select categoryId (string) in the Dynamic Menu Label Field drop-down menu and in the Dynamic Menu Value Field drop-down menu.
    1. For Dashboard Studio in Splunk Enterprise versions 8.3.1 and earlier, skip this step.
  10. Expand the Code section and change the Input ID to input_select_category.
  11. Select the donut chart visualization, and then select the edit icon (A pencil as an icon.) next to the Revenue by Game data source.
  12. Add your input token to the search by copying and pasting the following SPL after status=200:
    categoryId="$category$"
    

    You can interact with the visualizations powered by a data source after adding your newly defined token to that data source. After you edit the Revenue by Game data source, its SPL looks like this:

    index=main sourcetype=access_* action=purchase status=200 categoryId="$category$"
    | stats count values(price) as Price by productName productId 
    | table productName productId count Price
    | eval revenue=count*Price 
    | fields productName revenue
    | rename productName as "Game" revenue as "Revenue" 
    | sort -Revenue
    
  13. Select Apply & Close.
  14. Now select the table visualization, and then select the edit icon (A pencil as an icon.) next to the Most Purchased Games data source.
  15. Add your input token to the search by copying and pasting the following SPL after status=200:
    categoryId="$category$"
    

    After editing the Most Purchased Games data source, its SPL looks like this:

    index=main sourcetype=access_* action=purchase status=200 categoryId="$category$"
    | stats count as Purchases by productName price
    | table productName Purchases price
    | eval Revenue=Purchases*price
    | table productName Purchases Revenue
    | sort -Purchases | rename productName as "Game"
    | head 8
    
  16. Select Apply & Close.
  17. To test your input, select a category in the drop-down menu and watch the table, donut chart, and single value display data reflecting your selection.
  18. Reset the drop-down to All.

After completing Part 7, your chart looks similar to this:

An input dropdown with Arcade selected. A table and donut chart showing the most popular arcade games and their revenue.

Next step

You've completed Part 8 of the Splunk Dashboard Studio tutorial.

Now you can filter visualizations using the drop-down input. Next, use drilldown to set tokens on visualizations. Continue to Part 9: Add a drilldown.

Last modified on 22 December, 2022
Part 7 Add a map   Part 9 Add a drilldown

This documentation applies to the following versions of Splunk® Enterprise: 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters