https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-Table-Filtering-with-Varying-Field-Names/m-p/569570#M46790 <P>I was able to resolve this via hidden searches within a dashboard.&nbsp;<BR />I tokenized the lookup table based on a user dropdown, which then ran ~5 searches based on that, returning the tokenized objects I needed.</P> Mon, 04 Oct 2021 15:32:22 GMT mattfunk20 2021-10-04T15:32:22Z https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-Table-Filtering-with-Varying-Field-Names/m-p/568475#M46682 <P>Hi all!&nbsp;<BR />I've populated a table dynamically based on a drop down a user can manipulate using...&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">| inputlookup [| rest /services/saved/searches | fields title | search title=*$userInput$*.c | eval check=replace(title,"\.c",".csv") | return $check] </LI-CODE><P>&nbsp;</P><P>Additionally I can extrapolate each column into a dropdown using...</P><P>&nbsp;</P><LI-CODE lang="markup">| inputlookup [| rest /services/saved/searches | fields title | search title=*$userInput$*.c | eval check=replace(title,"\.c",".csv") | return $check] | eval value= [| inputlookup [| rest /services/saved/searches | fields title | search title=*$userInput$*.c | eval check=replace(title,"\.c",".csv") | return $check] | transpose | fields column | streamstats count(column) as order | where order = 2 | return $column] | fields value | table value | stats values(value) as value | mvexpand value</LI-CODE><P>&nbsp;</P><P>by varying order = #&nbsp;<BR /><BR /></P><P>The issue I'm running into now is pairing the drop down,&nbsp; the drop down with a set token of "filter1"<BR />Run within&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">| inputlookup [| rest /services/saved/searches | fields title | search title=*$userInput$*.c | eval check=replace(title,"\.c",".csv") | return $check] | search [| inputlookup [| rest /services/saved/searches | fields title | search title=*$userInput$*.c | eval check=replace(title,"\.c",".csv") | return $check] | head 1 | table * | transpose | head 1 | return $column] = $filter1$</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>The token is not functioning and will not populate in the query, while other tokens will. I've additionally confirmed the query works, just not when used with tokens within a dashboard.&nbsp;<BR /><BR />To summarize, the overall goal is to provide 4-6 drop downs and a table. Based on the initial user request, this table would populate with data, and each drop down would then be able to further filter data,&nbsp; with the field names and values all varying.<BR /><BR />If something isn't clear please ask and I'd be glad to provide, been banging my head against this one for awhile lol.</P> Sat, 25 Sep 2021 23:02:29 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-Table-Filtering-with-Varying-Field-Names/m-p/568475#M46682 mattfunk20 2021-09-25T23:02:29Z https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-Table-Filtering-with-Varying-Field-Names/m-p/568482#M46683 <P>Have you tried using token modifiers?</P><LI-CODE lang="markup">| return $column] = $filter1|s$</LI-CODE> Sun, 26 Sep 2021 09:39:01 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-Table-Filtering-with-Varying-Field-Names/m-p/568482#M46683 ITWhisperer 2021-09-26T09:39:01Z https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-Table-Filtering-with-Varying-Field-Names/m-p/569570#M46790 <P>I was able to resolve this via hidden searches within a dashboard.&nbsp;<BR />I tokenized the lookup table based on a user dropdown, which then ran ~5 searches based on that, returning the tokenized objects I needed.</P> Mon, 04 Oct 2021 15:32:22 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-Table-Filtering-with-Varying-Field-Names/m-p/569570#M46790 mattfunk20 2021-10-04T15:32:22Z