<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Add items in dropdown with fieldForValue in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Add-items-in-dropdown-with-fieldForValue/m-p/548566#M37799</link>
    <description>&lt;P&gt;I only need this queru to transform the values of the SCOPE field in Italian language:&lt;BR /&gt;Ottobre-2020&lt;BR /&gt;Novembre-2020&lt;BR /&gt;.&lt;BR /&gt;.&lt;BR /&gt;Febbraio-2021&lt;BR /&gt;Marzo-2021&lt;BR /&gt;Aprile-2021&lt;/P&gt;&lt;P&gt;There are no other data, I then take the data in the chart query where I use the $ filed1 $ variable obtained from the chosen month.&lt;BR /&gt;I want it to be the month before today by default.&lt;BR /&gt;I'll try your suggestion right away and let you know how it went &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;BR /&gt;Tks&lt;BR /&gt;Bye&lt;BR /&gt;Antonio&lt;/P&gt;</description>
    <pubDate>Tue, 20 Apr 2021 10:15:38 GMT</pubDate>
    <dc:creator>antonio147</dc:creator>
    <dc:date>2021-04-20T10:15:38Z</dc:date>
    <item>
      <title>Add items in dropdown with fieldForValue</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Add-items-in-dropdown-with-fieldForValue/m-p/548556#M37797</link>
      <description>&lt;P&gt;Hi,&lt;BR /&gt;I created a filter with all the months taken from the "SCOPE" field.&lt;BR /&gt;this contains 12 months back, in the dashboard I can have all the months written in Italian.&lt;BR /&gt;Now I would like the default to be the month prior to today.&lt;BR /&gt;I tried with&lt;BR /&gt;&amp;lt;default&amp;gt; $ A_data $ &amp;lt;/default&amp;gt;&lt;BR /&gt;&amp;lt;choice value = "$ A_data $"&amp;gt; PREVIOUS_MONTH &amp;lt;/choice&amp;gt;&lt;BR /&gt;but it does not work.&lt;BR /&gt;I would like it to be selected by Default (if today we are in April, "MARCH-2021" was selected)&lt;BR /&gt;Tks&lt;BR /&gt;Bye&lt;BR /&gt;Antonio&lt;/P&gt;&lt;P&gt;------ source -------&lt;/P&gt;&lt;P&gt;&amp;lt;form hideFilters="true"&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;lt;label&amp;gt; Results and Details: Web survey&amp;lt;/label&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;lt;fieldset submitButton="false"&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;input type="dropdown" token="field1"&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;label&amp;gt;Mese&amp;lt;/label&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;fieldForLabel&amp;gt;field1&amp;lt;/fieldForLabel&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;fieldForValue&amp;gt;AMBITO&amp;lt;/fieldForValue&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;search&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;query&amp;gt;index=aladin * sourcetype=cruscotto_tnps&lt;/P&gt;&lt;P&gt;|search ZONA ="Totale"&lt;/P&gt;&lt;P&gt;|eval anno=mvindex(split(AMBITO,"-"),1)&lt;/P&gt;&lt;P&gt;|eval mese=mvindex(split(AMBITO,"-"),0)&lt;/P&gt;&lt;P&gt;| eval mesi=case(&lt;/P&gt;&lt;P&gt;mese="Gennaio","01",&lt;/P&gt;&lt;P&gt;mese="Febbraio","02",&lt;/P&gt;&lt;P&gt;mese="Marzo","03",&lt;/P&gt;&lt;P&gt;mese="Aprile","04",&lt;/P&gt;&lt;P&gt;mese="Maggio","05",&lt;/P&gt;&lt;P&gt;mese="Giugno","06",&lt;/P&gt;&lt;P&gt;mese="Luglio","07",&lt;/P&gt;&lt;P&gt;mese="Agosto","08",&lt;/P&gt;&lt;P&gt;mese="Settembre","09",&lt;/P&gt;&lt;P&gt;mese="Ottobre","10",&lt;/P&gt;&lt;P&gt;mese="Novembre","11",&lt;/P&gt;&lt;P&gt;mese="Dicembre","12",&lt;/P&gt;&lt;P&gt;1=1, "INV")&lt;/P&gt;&lt;P&gt;|eval OrdineAmbito = anno.mesi&lt;/P&gt;&lt;P&gt;|sort OrdineAmbito&lt;/P&gt;&lt;P&gt;| eval A_mese=strftime(relative_time(now(), "-30d@d"),"%m")&lt;/P&gt;&lt;P&gt;| eval A_anno=strftime(relative_time(now(), "-30d@d"),"%Y")&lt;/P&gt;&lt;P&gt;| eval A_mesi=case(&lt;/P&gt;&lt;P&gt;A_mese="01","Gennaio",&lt;/P&gt;&lt;P&gt;A_mese="02","Febbraio",&lt;/P&gt;&lt;P&gt;A_mese="03","Marzo",&lt;/P&gt;&lt;P&gt;A_mese="04","Aprile",&lt;/P&gt;&lt;P&gt;A_mese="05","Maggio",&lt;/P&gt;&lt;P&gt;A_mese="06","Giugno",&lt;/P&gt;&lt;P&gt;A_mese="07","Luglio",&lt;/P&gt;&lt;P&gt;A_mese="08","Agosto",&lt;/P&gt;&lt;P&gt;A_mese="09","Settembre",&lt;/P&gt;&lt;P&gt;A_mese="10","Ottobre",&lt;/P&gt;&lt;P&gt;A_mese="11","Novembre",&lt;/P&gt;&lt;P&gt;A_mese="12","Dicembre",&lt;/P&gt;&lt;P&gt;1=1, "INV")&lt;/P&gt;&lt;P&gt;|eval A_data= A_mesi."-".A_anno&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;|table AMBITO,A_data&amp;lt;/query&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;earliest&amp;gt;@d&amp;lt;/earliest&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;/search&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;default&amp;gt;$A_data$&amp;lt;/default&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;choice value="$A_data$"&amp;gt;MESE_PRECEDENTE&amp;lt;/choice&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;/input&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;lt;/fieldset&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;lt;row&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;panel&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;html&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;div style="height: 2em;&amp;nbsp;&amp;nbsp; display: flex;&amp;nbsp;&amp;nbsp; align-items: center;&amp;nbsp;&amp;nbsp; justify-content: center;color:blue;font-style:bold;font-size:200%"&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;B&amp;gt; $field1$&amp;lt;/B&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;/div&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;/html&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;/panel&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;lt;/row&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;lt;row&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;panel&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;html&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;lt;/html&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;/panel&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;lt;/row&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;lt;row&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;panel&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;single&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;title&amp;gt;T-PRO&amp;lt;/title&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;search&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;query&amp;gt;index=aladin * sourcetype=cruscotto_tnps&lt;/P&gt;&lt;P&gt;|search ZONA ="Totale"&lt;/P&gt;&lt;P&gt;|eval anno = strftime(_time,"%Y")&lt;/P&gt;&lt;P&gt;| eval mesi=strftime(_time,"%m")&lt;/P&gt;&lt;P&gt;| eval mese=case(&lt;/P&gt;&lt;P&gt;mesi="01","Gennaio-",&lt;/P&gt;&lt;P&gt;mesi="02","Febbraio-",&lt;/P&gt;&lt;P&gt;mesi="03","Marzo-",&lt;/P&gt;&lt;P&gt;mesi="04","Aprile-",&lt;/P&gt;&lt;P&gt;mesi="05","Maggio-",&lt;/P&gt;&lt;P&gt;mesi="06","giugno-",&lt;/P&gt;&lt;P&gt;mesi="07","Luglio-",&lt;/P&gt;&lt;P&gt;mesi="08","Agosto-",&lt;/P&gt;&lt;P&gt;mesi="09","Settembre-",&lt;/P&gt;&lt;P&gt;mesi="10","Ottobre-",&lt;/P&gt;&lt;P&gt;mesi="11","Novembre",&lt;/P&gt;&lt;P&gt;mesi="12","Dicembre-",&lt;/P&gt;&lt;P&gt;1=1, "INV")&lt;/P&gt;&lt;P&gt;|eval meseanno= mese.anno&lt;/P&gt;&lt;P&gt;|where AMBITO = "$field1$"&lt;/P&gt;&lt;P&gt;|sort ZONA&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;|fields T_PRO&lt;/P&gt;&lt;P&gt;|stats values(T_PRO)&amp;lt;/query&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;earliest&amp;gt;@d&amp;lt;/earliest&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;/search&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;option name="drilldown"&amp;gt;none&amp;lt;/option&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;option name="height"&amp;gt;50&amp;lt;/option&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;option name="rangeColors"&amp;gt;["0x006d9c","0x53a051"]&amp;lt;/option&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;option name="rangeValues"&amp;gt;[500]&amp;lt;/option&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;option name="refresh.display"&amp;gt;none&amp;lt;/option&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;option name="useColors"&amp;gt;1&amp;lt;/option&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;/single&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;lt;/panel&amp;gt;&lt;/P&gt;</description>
      <pubDate>Tue, 20 Apr 2021 08:54:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Add-items-in-dropdown-with-fieldForValue/m-p/548556#M37797</guid>
      <dc:creator>antonio147</dc:creator>
      <dc:date>2021-04-20T08:54:51Z</dc:date>
    </item>
    <item>
      <title>Re: Add items in dropdown with fieldForValue</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Add-items-in-dropdown-with-fieldForValue/m-p/548561#M37798</link>
      <description>&lt;P&gt;The fieldForLabel and fieldForValue elements are the names of fields from your search query - your search query might return multiple rows for the same month depending on your data. Your could try something like this&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;    &amp;lt;input type="dropdown" token="month"&amp;gt;
      &amp;lt;label&amp;gt;Past 12 months&amp;lt;/label&amp;gt;
      &amp;lt;search&amp;gt;
        &amp;lt;query&amp;gt;| makeresults
| eval month=mvrange(1, 13)
| mvexpand month
| eval month=0-month
| eval _time=relative_time(_time,month."mon@mon")
| eval AMBITO=strftime(_time,"%Y-%m")
| eval mesi=strftime(_time,"%m")
| eval A_data=case(mesi="01","Gennaio-",
mesi="02","Febbraio-",
mesi="03","Marzo-",
mesi="04","Aprile-",
mesi="05","Maggio-",
mesi="06","giugno-",
mesi="07","Luglio-",
mesi="08","Agosto-",
mesi="09","Settembre-",
mesi="10","Ottobre-",
mesi="11","Novembre",
mesi="12","Dicembre-").strftime(_time,"%Y")
| table AMBITO A_data|&amp;lt;/query&amp;gt;
        &amp;lt;done&amp;gt;
          &amp;lt;set token="default"&amp;gt;$results.AMBITO$&amp;lt;/set&amp;gt;
        &amp;lt;/done&amp;gt;
      &amp;lt;/search&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;A_data&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;AMBITO&amp;lt;/fieldForValue&amp;gt;
      &amp;lt;selectFirstChoice&amp;gt;true&amp;lt;/selectFirstChoice&amp;gt;
    &amp;lt;/input&amp;gt;&lt;/LI-CODE&gt;</description>
      <pubDate>Tue, 20 Apr 2021 09:54:16 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Add-items-in-dropdown-with-fieldForValue/m-p/548561#M37798</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-04-20T09:54:16Z</dc:date>
    </item>
    <item>
      <title>Re: Add items in dropdown with fieldForValue</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Add-items-in-dropdown-with-fieldForValue/m-p/548566#M37799</link>
      <description>&lt;P&gt;I only need this queru to transform the values of the SCOPE field in Italian language:&lt;BR /&gt;Ottobre-2020&lt;BR /&gt;Novembre-2020&lt;BR /&gt;.&lt;BR /&gt;.&lt;BR /&gt;Febbraio-2021&lt;BR /&gt;Marzo-2021&lt;BR /&gt;Aprile-2021&lt;/P&gt;&lt;P&gt;There are no other data, I then take the data in the chart query where I use the $ filed1 $ variable obtained from the chosen month.&lt;BR /&gt;I want it to be the month before today by default.&lt;BR /&gt;I'll try your suggestion right away and let you know how it went &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;BR /&gt;Tks&lt;BR /&gt;Bye&lt;BR /&gt;Antonio&lt;/P&gt;</description>
      <pubDate>Tue, 20 Apr 2021 10:15:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Add-items-in-dropdown-with-fieldForValue/m-p/548566#M37799</guid>
      <dc:creator>antonio147</dc:creator>
      <dc:date>2021-04-20T10:15:38Z</dc:date>
    </item>
    <item>
      <title>Re: Add items in dropdown with fieldForValue</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Add-items-in-dropdown-with-fieldForValue/m-p/548568#M37800</link>
      <description>&lt;P class="lia-align-justify"&gt;Excellent !!!&lt;BR /&gt;It works perfectly and even the months are sorted from largest to smallest.&lt;BR /&gt;I had ordered with YEAR-MONTH to have 2021-04,2021-03, etc ...... but this is better.&lt;BR /&gt;In addition, SCOPE contains the values of the 12 months prior to today for which from April-2021 to April-2020.&lt;BR /&gt;Actually I don't need A_data, I just need SCOPE, to query the charts.&lt;/P&gt;&lt;P class="lia-align-justify"&gt;now I have to see what you did to understand the concept well&lt;/P&gt;&lt;P class="lia-align-justify"&gt;&lt;BR /&gt;thank you very much, you were really great !!!&lt;BR /&gt;Bye&lt;BR /&gt;Antonio&lt;/P&gt;</description>
      <pubDate>Tue, 20 Apr 2021 10:32:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Add-items-in-dropdown-with-fieldForValue/m-p/548568#M37800</guid>
      <dc:creator>antonio147</dc:creator>
      <dc:date>2021-04-20T10:32:49Z</dc:date>
    </item>
    <item>
      <title>Re: Add items in dropdown with fieldForValue</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Add-items-in-dropdown-with-fieldForValue/m-p/548685#M37813</link>
      <description>&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;    &amp;lt;input type="dropdown" token="field1"&amp;gt;
      &amp;lt;label&amp;gt;Mese&amp;lt;/label&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;A_data&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;AMBITO&amp;lt;/fieldForValue&amp;gt;
      &amp;lt;search&amp;gt;
        &amp;lt;query&amp;gt;index=idx sourcetype=source
|search ZONA ="Totale"
|eval anno=mvindex(split(AMBITO,"-"),1)
|eval mese=mvindex(split(AMBITO,"-"),0)
| eval mesi=case(
mese="Gennaio","01",
mese="Febbraio","02",
mese="Marzo","03",
mese="Aprile","04",
mese="Maggio","05",
mese="Giugno","06",
mese="Luglio","07",
mese="Agosto","08",
mese="Settembre","09",
mese="Ottobre","10",
mese="Novembre","11",
mese="Dicembre","12",
1=1, "INV")
|eval OrdineAmbito = anno.mesi
|sort - OrdineAmbito
|eval A_data= mese."-".anno
| append [| makeresults
| eval A_data="MESE_PRECEDENTE"]
| streamstats count as row
| eventstats values(eval(if(row=2,AMBITO,null))) as second
| eval AMBIIO=if(A_data="MESE_PRECEDENTE",second." ",AMBITO)
| table AMBITO A_data second&amp;lt;/query&amp;gt;
        &amp;lt;done&amp;gt;
          &amp;lt;set token="default"&amp;gt;$result.second$&amp;lt;/set&amp;gt;
        &amp;lt;/done&amp;gt;
        &amp;lt;earliest&amp;gt;@d&amp;lt;/earliest&amp;gt;
        &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
      &amp;lt;/search&amp;gt;
      &amp;lt;default&amp;gt;$default$&amp;lt;/default&amp;gt;
    &amp;lt;/input&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;When the field1 token is used, it should be trimmed due to the extra space added to avoid duplication of values.&lt;/P&gt;</description>
      <pubDate>Wed, 21 Apr 2021 06:09:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Add-items-in-dropdown-with-fieldForValue/m-p/548685#M37813</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-04-21T06:09:53Z</dc:date>
    </item>
  </channel>
</rss>

