Dropdown - how to keep duplicate values

cornemrc — Thu, 18 Jun 2020 13:34:33 GMT

Hello,

I am using a dropdown with a dynamic option search

| inputlookup serverlocations.csv

field for Label: locationname
field for Value: servername

The serverlocations.csv looks like this in a regular splunk search:

locationname	servername
UK-London	server1.example.com
DE-Berlin	server1.example.com
US-NewYork	server2.example.com

The problem is my dropdown shows only the Labels UK-London and US-NewYork. It removes DE-Berlin from the dropdown as if my search would be

| inputlookup serverlocations.csv | dedup servername

But actually I want all three locationnames in my dropdown. I am totally fine if I get the same search results on the dashboards then, because both are using the same servername. I do not understand why splunk is handling my search with a dedup, especially because my search result is looking good as long as it is not used by the dropdown.

Do you have a reason for that behaviour or can you tell me how to avoid that?

Re: Dropdown - how to keep duplicate values

niketn — Thu, 18 Jun 2020 19:10:35 GMT

@cornemrc try something like the following. SPL is used to create servername as delimited string after combining servername with locationname. Using <eval> to split the servername set the tokens servername and location name using $label$ on <change> of input value.

<input type="dropdown" token="serverlocation"> <label>Server/Location</label> <fieldForLabel>locationname</fieldForLabel> <fieldForValue>servername</fieldForValue> <selectFirstChoice>true</selectFirstChoice> <search> <query>| inputlookup serverlocations.csv | fields servername locationname | eval servername=servername."|".locationname</query> </search> <change> <eval token="servername">mvindex(split($value$,"|"),0)</eval> <set token="locationname">$label$</set> </change> </input>

topic Dropdown - how to keep duplicate values in Dashboards & Visualizations

Dropdown - how to keep duplicate values

Re: Dropdown - how to keep duplicate values