topic dropdown for the field in Dashboards & Visualizations

dropdown for the field

splunkpoornima — Mon, 03 Dec 2012 10:50:14 GMT

Hi all,

i have an log4j logs in that i have extracted the User names ...so now my field User has 79 user names what i need is i want a dropdown in that i want this 79 name to be in that list so that if i click any one of the name i want to see the log related to that Username

plz give an idea to proceed

thanks in advance,
poornima

Re: dropdown for the field

Drainy — Mon, 03 Dec 2012 10:55:32 GMT

A quick Google for, "Splunk forms drop down" revealed;

http://docs.splunk.com/Documentation/Splunk/4.3/Developer/AddDropDowns

Let us know if you hit any specific problem or issue

Re: dropdown for the field

splunkpoornima — Mon, 28 Sep 2020 12:54:08 GMT

I verifed the given link and i craeted the code as below

"UserExtraction" has source="AMGDCPROSAPPP1.log"| rex FIELD=_raw "User: (?.*)"|stats values(User)

correct me if i went wrong in the above code

Re: dropdown for the field

Ayn — Mon, 03 Dec 2012 12:17:13 GMT

stats values(User) returns just one event. That won't work. Study the link Drainy gave you. It clearly shows how all examples have one line per item in the dropdown.

Re: dropdown for the field

splunkpoornima — Mon, 03 Dec 2012 13:05:33 GMT

Hi ayn,

I got the answer..but one small problem..

i have inserted the * but this * is not geting listed down in the dropdown

Re: dropdown for the field

Ayn — Mon, 03 Dec 2012 13:14:49 GMT

Well, as you can see in the DOCS *hint*...

<default>    The default option to select.

If the default option cannot be found, the first option is selected.

Re: dropdown for the field

splunkpoornima — Mon, 03 Dec 2012 13:37:59 GMT

hi ayn i found the answer for that..

i used choice value ...

thanks

Re: dropdown for the field

splunkpoornima — Mon, 03 Dec 2012 13:41:30 GMT

please verify the attachment contains the ouput..

in that table i want to remove the _time coloumn alone

plz suggest the way

Re: dropdown for the field

smolcj — Mon, 03 Dec 2012 13:44:28 GMT

your search | fields - _time

Re: dropdown for the field

splunkpoornima — Mon, 03 Dec 2012 13:49:10 GMT

<![CDATA[source="C:\Users\20875\Desktop\pros-Tomcat-AMGDCPROSAPPP1.log"
| rex FIELD=_raw "User: (?.*)"
| stats count by User]]>

Transaction
source="C:\Users\20875\Desktop\pros-Tomcat-AMGDCPROSAPPP1.log" $username$

after run this code.i got the table as above with time field ..but i want to remove that

Re: dropdown for the field

sruthy — Mon, 03 Dec 2012 13:56:01 GMT

searchtemplate>source="C:\Users\20875\Desktop\pros-Tomcat-AMGDCPROSAPPP1.log" $username$|fields - _time </searchtemplate>

or
searchtemplate>source="C:\Users\20875\Desktop\pros-Tomcat-AMGDCPROSAPPP1.log" $username$|fields host index ..... </searchtemplate>

Re: dropdown for the field

splunkpoornima — Mon, 03 Dec 2012 13:59:26 GMT

thanks guys..
its working!!!!

Re: dropdown for the field

smolcj — Mon, 03 Dec 2012 14:00:21 GMT

Cool... enjoy splunking 🙂