topic Re: Dynamic Dropdown All option issue in Dashboards & Visualizations

How to achieve dynamic dropdown all option?

Aroot002 — Mon, 24 Oct 2022 19:57:22 GMT

So I've searched and searched but can't seem to find an answer to my issue. I need to add an all option to my dynamic dropdown. I have found answers that seem like they should be simple enough. Either add All, * to static or alter the XML code. I've tried both, (I think when I altered the XML code it pretty much caused the dropdown to be the exact same way as it was had I just added the options to the static section) and each time I am getting a "search string cannot be empty" error. Don't know if it matters but I did watch a couple youtube videos, their search used | table fieldname | dedup fieldname at the end, when I did that I got the same issue, but now all the field values are grouped together, so I'm doing | stats count by fieldname at the end

Re: Dynamic Dropdown All option issue

johnhuang — Mon, 24 Oct 2022 19:45:55 GMT

This is how I would typically configure it:

Re: Dynamic Dropdown All option issue

Aroot002 — Mon, 24 Oct 2022 19:52:23 GMT

Same issue, says that it's ignoring search expansion due to error "search string cannot be empty"

Re: Dynamic Dropdown All option issue

johnhuang — Mon, 24 Oct 2022 20:10:26 GMT

Could you click on the magnifying glass to "Open in search" and provide the query?

Re: Dynamic Dropdown All option issue

Aroot002 — Mon, 24 Oct 2022 20:16:56 GMT

I'm actually working on my other computer, but I did click the glass, I got the same error when the search opened, could this be more of a log issue? I actually swapped it out for another field and did not get the error.

Re: Dynamic Dropdown All option issue

johnhuang — Mon, 24 Oct 2022 20:19:53 GMT

I think it's more of a query issue - could you provide a sample of the query when open to a new search?

Re: Dynamic Dropdown All option issue

Aroot002 — Mon, 24 Oct 2022 20:23:52 GMT

I actually just did a simple search to test it out. index=index_name source_type=windows fieldname=* and that got the error. Also tried with quotation marks. But if I change the fieldname to a different one I don't get that error. I don't have a lot of experience in this so I immediately assumed it was something I am doing.

Re: Dynamic Dropdown All option issue

johnhuang — Mon, 24 Oct 2022 20:26:41 GMT

Just to confirm,

You ran:

index=index_name source_type=windows fieldname=*

and got an error "search string cannot be empty"?

Re: Dynamic Dropdown All option issue

Aroot002 — Mon, 24 Oct 2022 20:29:09 GMT

Yes, the error is "Ignoring fieldname "value1" for search expansion due to error="search string cannot be empty"

"Ignoring fieldname "value2" for search expansion due to error="search string cannot be empty"

Re: Dynamic Dropdown All option issue

johnhuang — Mon, 24 Oct 2022 20:40:25 GMT

If possible, could you provide a screenshot.

Re: Dynamic Dropdown All option issue

Aroot002 — Wed, 26 Oct 2022 21:34:08 GMT

I'm actually accepting your first response as a solution... essentially your answer was the correct one. My problem was being caused by an underlying issue with the logs I am querying.