topic Re: Dropdown not working with basesearch in Splunk Dev

Why is dropdown not working with basesearch?

junmun-chan — Mon, 03 Apr 2023 20:01:10 GMT

Hi,

I have created a base search, and have an event table to display the results. Problem is, only the 'All' value is working correctly. When i select other options, nothing is being display. The dropdown is showing me the correct options. Below is my codes, i have changed some of the words, as i can't use the actual data here.

This is my base search, i have set it up at the top

<form theme="dark"> <label>Profiles</label> <search id="baseSearch"> <query>source="ErrorLog" ESPACE_NAME IN (Customer, Vendors, Friends) | replace "Customer" WITH "Customer Name", "Vendors" with "Vendors Name", "Friends" WITH "Friends Name" IN ESPACE_NAME</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <refresh>5m</refresh> <refreshType>delay</refreshType> </search> <fieldset submitButton="false" autoRun="true"> <input type="time" token="field1"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset>

This is the codes for my dropdown

<panel> <title>Error Log</title> <input type="dropdown" token="ProfileLog" searchWhenChanged="true"> <label>Module</label> <fieldForLabel>ESPACE_NAME</fieldForLabel> <fieldForValue>ESPACE_NAME</fieldForValue> <search base="baseSearch"> <query>| stats count by ESPACE_NAME</query> </search> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> </input> <event> <search base="baseSearch"> <query>| search ESPACE_NAME=$ProfileLog$</query> </search> <option name="list.drilldown">none</option> <option name="refresh.display">progressbar</option> </event> </panel> </row> </form>

Any assistance is appreciated!! Thank you

Re: Dropdown not working with basesearch

scelikok — Mon, 03 Apr 2023 11:16:17 GMT

Hi @junmun-chan,

Since your token values contains spaces you have use tokens between double-quotes like below;

<panel> <title>Error Log</title> <input type="dropdown" token="ProfileLog" searchWhenChanged="true"> <label>Module</label> <fieldForLabel>ESPACE_NAME</fieldForLabel> <fieldForValue>ESPACE_NAME</fieldForValue> <search base="baseSearch"> <query>| stats count by ESPACE_NAME</query> </search> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> </input> <event> <search base="baseSearch"> <query>| search ESPACE_NAME="$ProfileLog$"</query> </search> <option name="list.drilldown">none</option> <option name="refresh.display">progressbar</option> </event> </panel> </row> </form>

Re: Dropdown not working with basesearch

junmun-chan — Tue, 04 Apr 2023 01:09:56 GMT

Oh yes scelikok, it works now!

Thank you!!