Splunk Cloud Platform

Splunk Dashboard Studio

Part 7: Add an input

Buttercup Games sells many different games, and on the dashboard, it's difficult to scan through all the games to find the one you're looking for. In this part of the tutorial, add a dropdown menu input to your dashboard to filter the visualizations by any game you choose. After you add an input, you must define the input token name and apply the token to data sources powering the visualizations you want to filter.

  1. Select the add input icon (Three horizontal sliding toggles as an icon.) in the editing toolbar, and then select Dropdown.
  2. In the Configuration panel, change Display from Above canvas to In canvas.
  3. Position the Dropdown to fit in the top left rectangle.
  4. In the Configuration panel, give your input the following title and token name.
    1. Title: Select Game Category
    2. Token name: category
  5. In the Menu configuration section, remove the Item 1 and Item 2 rows (An X.) so that there is only one value in the table: Static menu configuration with two columns: Label and Value. Beneath Label is the word "All" and beneath Value is an asterisk.
  6. In the Data sources section, select + Set up Primary Data Source.
  7. Select + Create Search and name it Games Categories.
  8. Add your search. For this tutorial, copy and paste the following search into the SPL Query field:
    index=main sourcetype=access_* action=purchase status=200 
    | stats count by categoryId
    
    This query aggregates all purchases based on the category of game that each purchase belongs to.
  9. Select Apply & Close.
  10. In the Menu configuration section of the Configuration panel, select categoryId (string) in the Dynamic Menu Label Field dropdown menu as well as in the Dynamic Menu Value Field dropdown menu.
  11. In the Color and style section of the Configuration panel, change the Background to transparent.
  12. Select the Total Revenue visualization on your dashboard, and then select the edit icon (A pencil as an icon.) next to the Total Revenue data source.
  13. Add your input token to the search by copying and pasting the following SPL before | stats sum(Revenue)
    | search Category=$category$ 
    

    This SPL sets the category used in all the visualizations as the category you select in the input dropdown. You can interact with the visualizations powered by a data source after adding your newly defined token to that data source. After editing the Total Revenue data source, its SPL looks like this:

    | search Category=$category$ | stats sum(Revenue)
    
  14. Select Apply & Close.
  15. Next, select the map visualization, and then select the edit icon (A pencil as an icon.) next to the Purchase Locations data source.
  16. Add your input token to the search by copying and pasting the following SPL after status=200
    categoryId="$category$"
    

    This SPL sets the category used in all the visualizations as the category you select in the input dropdown. After editing the Total Revenue data source, its SPL looks like this:

    index=main sourcetype=access_* action=purchase status=200 categoryId="$category$" productName="*"
    | iplocation clientip
    | lookup geo_countries latitude AS lat longitude AS lon OUTPUT featureId AS country
    | stats count by country
    | geom geo_countries featureIdField=country
    
  17. Select Apply & Close.
  18. To test your input, select a category in the dropdown menu and watch the single value visualization and map display data reflecting your selection.
  19. Reset the dropdown menu to All.

After completing Part 7, your chart looks similar to this:

An input dropdown with Arcade selected. A single value visualization of total revenue and a map showing where the most Arcade games were sold.

Next step

You've completed Part 7 of the Splunk Dashboard Studio tutorial and you can filter what values appear in visualizations using the dropdown input. Next, finish up your dashboard by saving and exporting the final product. Continue to Part 8: Save and export the dashboard.

Last modified on 29 June, 2023
Part 6: Add a map   Part 8: Save and export the dashboard

This documentation applies to the following versions of Splunk Cloud Platform: 9.2.2406, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403 (latest FedRAMP release)


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters