topic Re: Populating dropdown error : Could not create search in Dashboards & Visualizations

Populating dropdown error : Could not create search

Naren26 — Fri, 08 Dec 2017 07:20:25 GMT

I am trying to populate values to a dropdown using the search query. Following is the code:

<input type="dropdown" token="sub_tok" searchWhenChanged="true">
      <label>Subdivisions List</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>subdivision</fieldForLabel>
      <fieldForValue>subdivision</fieldForValue>
      <search>
        <query>`mymainlog` | rex field=_raw max_match=100 "<(<subdivision>\d{4})," | stats values(subdivision) as subDivs | mvexpand subDivs | rename subDivs as SubDivisionList </query>
        <earliest>-15m</earliest>
    <latest>now</latest>
      </search>
      <delimiter> </delimiter>
    </input>

But I am getting this error Could not create search. But this query is running perfectly fine when executing it as a new search. I am getting almost 40 rows in the search results. But none is getting populated to the dropdown. I had even tried adding head 5, in order to limit the number of rows, but of no luck.

I am using Splunk version 6.5.4

Please help me out.

Re: Populating dropdown error : Could not create search

niketn — Fri, 08 Dec 2017 09:13:26 GMT

@Naren26, can you try escaping the angular brackets < and > with <and > in you search query for the drop down?

Alternatively, you can save your working query as a dashboard panel and then copy paste to the input search query. Please try out and confirm.

Re: Populating dropdown error : Could not create search

micahkemp — Tue, 12 Dec 2017 00:03:57 GMT

Your search query returns a field SubDivisionList but your input is set to use the field subdivision. Your input is looking for a field that doesn't exist so it has no values to display.

Re: Populating dropdown error : Could not create search

Naren26 — Thu, 14 Dec 2017 05:09:54 GMT

This has done the trick. Thanks

Re: Populating dropdown error : Could not create search

niketn — Thu, 14 Dec 2017 08:26:13 GMT

@Naren26, I have converted to answer. Please accept to mark this as answered.