https://community.splunk.com/t5/Splunk-Dev/dropdown/m-p/521751#M9334 <P>This doesn't sound like the full story!</P><P>However, why not create your first dropdown with this query</P><LI-CODE lang="markup">| inputlookup ... | search TITLE = "*Microsoft*" OR TITLE = "*Windows*" | eval new_date=strftime(strptime(PUBLISHED_DATETIME,"%Y-%m-%d"),"%Y") | dedup new_date | fields new_date | sort - new_date</LI-CODE><P>and your second dropdown with this query</P><LI-CODE lang="markup">| inputlookup ... | search TITLE = "*Microsoft*" OR TITLE = "*Windows*" | eval new_date=strftime(strptime(PUBLISHED_DATETIME,"%Y-%m-%d"),"%b") | dedup new_date | fields new_date | sort - new_date</LI-CODE> Mon, 28 Sep 2020 10:18:12 GMT ITWhisperer 2020-09-28T10:18:12Z https://community.splunk.com/t5/Splunk-Dev/dropdown/m-p/521750#M9333 <P>i have one dropdown with month and year how can i separate and make 2 dropdown , one for month another one for year</P><P>&nbsp;</P><P>my query is this</P><P>| inputlookup ... | search TITLE = "*Microsoft*" OR TITLE = "*Windows*"<BR /><BR />| eval new_date=strftime(strptime(PUBLISHED_DATETIME,"%Y-%m-%d"),"%Y %b")<BR />| dedup new_date<BR />| table new_date PUBLISHED_DATETIME<BR />| sort - new_date</P> Mon, 28 Sep 2020 09:41:46 GMT https://community.splunk.com/t5/Splunk-Dev/dropdown/m-p/521750#M9333 dall 2020-09-28T09:41:46Z https://community.splunk.com/t5/Splunk-Dev/dropdown/m-p/521751#M9334 <P>This doesn't sound like the full story!</P><P>However, why not create your first dropdown with this query</P><LI-CODE lang="markup">| inputlookup ... | search TITLE = "*Microsoft*" OR TITLE = "*Windows*" | eval new_date=strftime(strptime(PUBLISHED_DATETIME,"%Y-%m-%d"),"%Y") | dedup new_date | fields new_date | sort - new_date</LI-CODE><P>and your second dropdown with this query</P><LI-CODE lang="markup">| inputlookup ... | search TITLE = "*Microsoft*" OR TITLE = "*Windows*" | eval new_date=strftime(strptime(PUBLISHED_DATETIME,"%Y-%m-%d"),"%b") | dedup new_date | fields new_date | sort - new_date</LI-CODE> Mon, 28 Sep 2020 10:18:12 GMT https://community.splunk.com/t5/Splunk-Dev/dropdown/m-p/521751#M9334 ITWhisperer 2020-09-28T10:18:12Z