<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Classic Dashboard Input Dynamic Options in Knowledge Management</title>
    <link>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699454#M10303</link>
    <description>&lt;P&gt;As luck would have it&lt;/P&gt;
&lt;P&gt;This works :&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;| inputlookup servers | dedup host | sort host | table host host&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;However, this does not&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;| inputlookup servers where environment = $token$

| dedup host | sort host | table host host&lt;/LI-CODE&gt;
&lt;P&gt;.........&lt;/P&gt;
&lt;P&gt;If I replace $token$ w/ "DEV" (which is what is in the table) it works.&amp;nbsp; I know the $token$ has the value, out of scope maybe?&lt;/P&gt;</description>
    <pubDate>Wed, 18 Sep 2024 19:02:39 GMT</pubDate>
    <dc:creator>texascj</dc:creator>
    <dc:date>2024-09-18T19:02:39Z</dc:date>
    <item>
      <title>Classic Dashboard Input Dynamic Options</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699317#M10288</link>
      <description>&lt;P&gt;Imagine, if you will,&amp;nbsp;table view lookup that has been setup to pull the Host name, the environment (Dev/Test/Prod) and the Server type (Database, Web App, SSO, etc...) and the application the server supports.&lt;/P&gt;&lt;P&gt;I have 4 Input field LOVs setup.&lt;/P&gt;&lt;P&gt;1. Enclave...lets me choose Dev / Test / Prod, those are the only 3 options and the token name is "enclave"&lt;/P&gt;&lt;P&gt;2. Type...shows Database, Web App, SSO, Other ... again those are the only options, token name is "type"&lt;/P&gt;&lt;P&gt;3. Application...say HR, Payroll, Order Entry and HealthCare ... again, 4 options, token name is "app"&lt;/P&gt;&lt;P&gt;4.&amp;nbsp; This should be a DYNAMIC LOV that shows only the servers in the table view lookup that meet the condition set by the first 3 LOVs.&lt;/P&gt;&lt;P&gt;...example&lt;/P&gt;&lt;P&gt;Enclave set to Dev, Type set to Web App, Application set to HR.&amp;nbsp; My table view clearly shows there are 2 web app server names so the 4th LOV should show Server003, Server007, All.&amp;nbsp; The token would then be set based on the choice (003 or 007) and if "All" were picked the token would be Server003, Server007.&amp;nbsp; This would drive the panel searches.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Is this possible?&amp;nbsp; I can get the 4th LOV to run but it doesn't give me a list.&lt;/P&gt;</description>
      <pubDate>Tue, 17 Sep 2024 19:19:59 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699317#M10288</guid>
      <dc:creator>texascj</dc:creator>
      <dc:date>2024-09-17T19:19:59Z</dc:date>
    </item>
    <item>
      <title>Re: Classic Dashboard Input Dynamic Options</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699322#M10291</link>
      <description>&lt;P&gt;Dropdown inputs can be set by a static list or a dynamic list or a combination of both. For a dynamic list, the search should return unique values for the list. So, in your instance, this could be filtering from a lookup table which holds all your servers, or by an index search to pull all the servers from your logs (although you would probably still need a lookup to get the other fields).&lt;/P&gt;</description>
      <pubDate>Tue, 17 Sep 2024 19:39:07 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699322#M10291</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2024-09-17T19:39:07Z</dc:date>
    </item>
    <item>
      <title>Re: Classic Dashboard Input Dynamic Options</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699323#M10292</link>
      <description>&lt;P&gt;That is how I understood it should work.&amp;nbsp; However, when I create the list input and go to the Dynamic Option and create the query...it returns nothing...it just says "Populating" so I know the query ran.&amp;nbsp; If I click on the link to run the query in a search window, I can see results.&lt;/P&gt;</description>
      <pubDate>Tue, 17 Sep 2024 19:53:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699323#M10292</guid>
      <dc:creator>texascj</dc:creator>
      <dc:date>2024-09-17T19:53:11Z</dc:date>
    </item>
    <item>
      <title>Re: Classic Dashboard Input Dynamic Options</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699324#M10293</link>
      <description>&lt;P&gt;Could you post the sanitized source code of your dashboard or inputs? It sounds like you are doing the right thing in using a dynamically populated 4th LOV, but maybe something isn't set right if the search is running but not populating the final LOV.&lt;/P&gt;</description>
      <pubDate>Tue, 17 Sep 2024 20:07:42 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699324#M10293</guid>
      <dc:creator>marnall</dc:creator>
      <dc:date>2024-09-17T20:07:42Z</dc:date>
    </item>
    <item>
      <title>Re: Classic Dashboard Input Dynamic Options</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699332#M10295</link>
      <description>&lt;P&gt;You should ensure the tokens always have a value by setting them in an init block - just using an initial / default value is not enough to set the input token to a value.&lt;/P&gt;</description>
      <pubDate>Tue, 17 Sep 2024 22:42:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699332#M10295</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2024-09-17T22:42:34Z</dc:date>
    </item>
    <item>
      <title>Re: Classic Dashboard Input Dynamic Options</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699398#M10297</link>
      <description>&lt;P&gt;At the moment the query reads as :&lt;/P&gt;&lt;P class="lia-indent-padding-left-30px"&gt;| inputlookup my_servers&lt;/P&gt;&lt;P class="lia-indent-padding-left-30px"&gt;| stats values(host)&lt;/P&gt;&lt;P&gt;Obviously there is no token at the moment to restrict the list so I should get a rather long list of servers to select from.&lt;/P&gt;&lt;P&gt;The source for the XML frame or block is&lt;/P&gt;&lt;P&gt;&amp;lt;input type="multiselect" token="SERVERS"&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;&amp;lt;label&amp;gt;SERVERS&amp;lt;/label&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;&amp;lt;search&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;lt;query&amp;gt; | inputlookup servers&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| stats values(host)&amp;lt;/query&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;&amp;lt;/search&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;&amp;lt;fieldForLabel&amp;gt;host&amp;lt;/fieldForLabel&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;&amp;lt;fieldForValue&amp;gt;host&amp;lt;/fieldForValue&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;&amp;lt;delimiter&amp;gt; &amp;lt;/delimiter&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;lt;/input&amp;gt;&lt;/P&gt;</description>
      <pubDate>Wed, 18 Sep 2024 12:18:43 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699398#M10297</guid>
      <dc:creator>texascj</dc:creator>
      <dc:date>2024-09-18T12:18:43Z</dc:date>
    </item>
    <item>
      <title>Re: Classic Dashboard Input Dynamic Options</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699402#M10299</link>
      <description>&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Try something like this&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;query&amp;gt; | inputlookup servers
        | where Enclave="$ENCLAVE$" AND Type="$Type$" AND Application="$APPLICATION$"
        | stats values(host) as host&amp;lt;/query&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Otherwise the field name is "values(host)" which doesn't match with fieldForLabel and fieldForValue&lt;/P&gt;</description>
      <pubDate>Wed, 18 Sep 2024 12:34:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699402#M10299</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2024-09-18T12:34:37Z</dc:date>
    </item>
    <item>
      <title>Re: Classic Dashboard Input Dynamic Options</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699406#M10300</link>
      <description>&lt;P&gt;Okay...almost there.&lt;/P&gt;&lt;P&gt;Adding the "as host" evidently forces the column / field name to read as "host" which must match the property setting of the UI.&amp;nbsp; Simple enough.&lt;/P&gt;&lt;P&gt;However, the query is returning a string rather than several strings.&amp;nbsp; So, my expected result for the field would be to see&lt;/P&gt;&lt;P class="lia-indent-padding-left-30px"&gt;Server001&lt;/P&gt;&lt;P class="lia-indent-padding-left-30px"&gt;Server004&lt;/P&gt;&lt;P class="lia-indent-padding-left-30px"&gt;Server007&lt;/P&gt;&lt;P&gt;...but what I get is&lt;/P&gt;&lt;P class="lia-indent-padding-left-30px"&gt;Server001Server004Server007&lt;/P&gt;&lt;P&gt;Is it possible to get these to be individual choices?&lt;/P&gt;</description>
      <pubDate>Wed, 18 Sep 2024 13:14:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699406#M10300</guid>
      <dc:creator>texascj</dc:creator>
      <dc:date>2024-09-18T13:14:53Z</dc:date>
    </item>
    <item>
      <title>Re: Classic Dashboard Input Dynamic Options</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699409#M10301</link>
      <description>&lt;P&gt;The multiselect dropdown is essentially a multi-value field. This can be delimited (using the delimiter option) for example setting it to a comma. Since you have string values, you might want to set valuePrefix and valueSuffix to double quotes ("), then you can use the token in a IN clause. That is, it depends on how you are using the token in your dashboard searches.&lt;/P&gt;</description>
      <pubDate>Wed, 18 Sep 2024 13:22:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699409#M10301</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2024-09-18T13:22:46Z</dc:date>
    </item>
    <item>
      <title>Re: Classic Dashboard Input Dynamic Options</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699424#M10302</link>
      <description>&lt;P&gt;Finally got what I wanted.&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;| inputlookup servers | dedup host | sort host | table host host&lt;/LI-CODE&gt;
&lt;P&gt;&lt;SPAN&gt;...this gives me the delineated list of servers that are individually selectable.&amp;nbsp; Now I need to add my parameter tokens to trim the list down based on the first 3 LOVs.&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;Thanks all!&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 18 Sep 2024 17:12:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699424#M10302</guid>
      <dc:creator>texascj</dc:creator>
      <dc:date>2024-09-18T17:12:09Z</dc:date>
    </item>
    <item>
      <title>Re: Classic Dashboard Input Dynamic Options</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699454#M10303</link>
      <description>&lt;P&gt;As luck would have it&lt;/P&gt;
&lt;P&gt;This works :&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;| inputlookup servers | dedup host | sort host | table host host&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;However, this does not&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;| inputlookup servers where environment = $token$

| dedup host | sort host | table host host&lt;/LI-CODE&gt;
&lt;P&gt;.........&lt;/P&gt;
&lt;P&gt;If I replace $token$ w/ "DEV" (which is what is in the table) it works.&amp;nbsp; I know the $token$ has the value, out of scope maybe?&lt;/P&gt;</description>
      <pubDate>Wed, 18 Sep 2024 19:02:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699454#M10303</guid>
      <dc:creator>texascj</dc:creator>
      <dc:date>2024-09-18T19:02:39Z</dc:date>
    </item>
    <item>
      <title>Re: Classic Dashboard Input Dynamic Options</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699585#M10304</link>
      <description>&lt;P&gt;Update&lt;/P&gt;
&lt;P&gt;While this works :&lt;/P&gt;
&lt;PRE&gt;| inputlookup servers | dedup host | sort host | table host host&lt;/PRE&gt;
&lt;P&gt;The issue I have here is I need to use the token to shrink the returned list.&amp;nbsp; As noted above, this DOES NOT work:&lt;/P&gt;
&lt;PRE&gt;| inputlookup servers where environment = $token$

| dedup host | sort host | table host host&lt;/PRE&gt;
&lt;P&gt;&amp;nbsp;...this returns NOTHING and I've spent several hours going bald trying to figure this out.&amp;nbsp; Then I found it.&lt;/P&gt;
&lt;P&gt;The issue is the WHERE clause.&amp;nbsp; Apparently, you cannot do an inputlookup to return 1 field while doing the comparision on another field.&amp;nbsp; Who knew?&amp;nbsp; So if the query is returning both the host AND the environment...then it works.&lt;/P&gt;
&lt;P&gt;What I ended up with is:&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;| inputlook servers

| table host, environment

| where environment = "$token$"

| fields - environment&lt;/LI-CODE&gt;
&lt;P&gt;...and now it's happy.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Thanks to all as I wouldn't haven't this far w/o getting the answers to my stupid questions!&amp;nbsp; &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Thu, 19 Sep 2024 14:17:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Classic-Dashboard-Input-Dynamic-Options/m-p/699585#M10304</guid>
      <dc:creator>texascj</dc:creator>
      <dc:date>2024-09-19T14:17:20Z</dc:date>
    </item>
  </channel>
</rss>

