topic Re: How to populate dropdown from lookup table? in Dashboards & Visualizations

How to populate dropdown from lookup table?

splunkuser320 — Wed, 31 May 2023 03:11:10 GMT

Hi, I need to populate the dropdown from the lookup table. I can only drop down labels from the lookup table, not the value. I need to use filter the dashboard based on the selected value. Currently, label is passing to the queries in the dashboard.

Re: How to populate dropdown from lookup table?

Manasa_401 — Wed, 31 May 2023 05:17:55 GMT

Hello @splunkuser320

You have to give the lookup and table the required field you want to use as a dropdown.
In below example code, sample is the name of lookup and abc is the output field I wanted to display. So, you will get the values from abc field in the dropdown list for selection

<input type="multiselect" token="tok_name" searchWhenChanged="true"> <label>Dropdown</label> <fieldForLabel>abc</fieldForLabel> <fieldForValue>abc</fieldForValue> <search> <query>|inputlookup sample |table abc</query> <earliest>0</earliest> <latest></latest> </search> </input>

If this helps you, an upvote would be appreciated.

Re: How to populate dropdown from lookup table?

Manasa_401 — Wed, 31 May 2023 05:21:11 GMT

To use this dropdown selected value in dashboard query, pass the token- $tok_name$ to the SPL.

example:
|where abc="$tok_name$"

Re: How to populate dropdown from lookup table?

isoutamo — Wed, 31 May 2023 06:26:43 GMT

Hi
If you want dropdown you should switch type="dropdown" instead of multiselect. Also I propose to use $tok_name|s$ instead of $tok_name$ to avoid issues if values have e.g. spaces. Without |s it could cause some issues with correct values. Another option for you could be to use "$tok_name$".
r. Ismo