topic Re: Unable to populate dropdown dynamically using PostProcess Search. Error: "Could not create search" in Dashboards & Visualizations

Unable to populate dropdown dynamically using PostProcess Search. Error: "Could not create search"

ishangajera — Fri, 31 Jul 2015 04:57:53 GMT

For my music2.csv file with content as below:

"artist_name","track_name"
Rihanna,"You Da One"
Rihanna,"We Found Love"

I want to load dropdown with the distinct artist_names using a basesearch and post-process search as below:

<form>
  <label>Error Macro Dashboard</label>
  <search id="baseSearch">
    <query>|inputlookup music2.csv | stats count by artist_name</query>
  </search>
<fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="tok_artist_name">
      <label>Select Artist</label>
      <search base="baseSearch">
        <query>search artist_name="R*"</query>
      </search>
      <fieldForLabel>artist_name</fieldForLabel>
      <fieldForValue>artist_name</fieldForValue>
    </input>
</fieldset>
</form>

But on screen the dropdown doesn't populate with any values and below dropdown an error msg is show as:
Could not create search.

Re: Unable to populate dropdown dynamically using PostProcess Search. Error: "Could not create search"

gcato — Mon, 03 Aug 2015 05:35:48 GMT

There is a detailed example with the correct format in the documentation here:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/Buildandeditforms#Create_a_form_with_a_global_search

Using your example code and the documentation the the correct syntax would look something like this (not tested).

 <search id="baseSearch">
   <query>|inputlookup music2.csv | stats count by artist_name</query>
 </search>
 <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="tok_artist_name">
      <label>Select Artist</label>
      <default>R*</default>
      <choice value="search artist_name="R*"">R*</choice>
      ... etc ...

    </input> 

 </fieldset>

Re: Unable to populate dropdown dynamically using PostProcess Search. Error: "Could not create search"

ishangajera — Mon, 03 Aug 2015 06:18:08 GMT

Hi,

Actually I want the dropdown with distinct artist_names from the output of basesearch.
The above solution will populate dropdown with single item as "R*"

Re: Unable to populate dropdown dynamically using PostProcess Search. Error: "Could not create search"

lavanyaanne — Tue, 29 Sep 2020 06:52:17 GMT

If You want to Display Dynamically you have to mention something in Query you are just searching search artist_name="R*"

so as per my view search artist_name="R*"|stats count by artist_name know you will get the list of Artists names starts with R

Re: Unable to populate dropdown dynamically using PostProcess Search. Error: "Could not create search"

ishangajera — Mon, 03 Aug 2015 12:53:29 GMT

Hi,

The data is not the issue, the issue is my dropdown is not accepting base search as I have done in my first post. It is expecting full search query.

Re: Unable to populate dropdown dynamically using PostProcess Search. Error: "Could not create search"

gcato — Mon, 03 Aug 2015 22:07:47 GMT

Okay, I see what you mean now. I couldn't get it to work either until I added a Submit button, then it populated okay. I'm sure there's a good reason why.

Here's the code I used (with Submit) that worked.

<form>
  <label>Artist Name</label>
  <search id="baseSearch">
    <query>|inputlookup music2.csv |stats values(artist_name) as artist_name, list(track_name) as track_name, count as count_artist_tracks</query>
  </search>
  <fieldset submitButton="true" autoRun="true">
    <input type="dropdown" token="tok_artist_name" searchWhenChanged="true">
      <label>Select Artist</label>
      <search base="baseSearch">
        <query>fields artist_name |sort artist name</query>
      </search>
      <fieldForLabel>artist_name</fieldForLabel>
      <fieldForValue>artist_name</fieldForValue>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search base="baseSearch">
          <query>search artist_name=$tok_artist_name|s$ |table *</query>
          <earliest></earliest>
          <latest></latest>
        </search>
      </table>
    </panel>
  </row>
</form>

You may be aware already, but watch out for the 10k limit on global and post-searches.

Re: Unable to populate dropdown dynamically using PostProcess Search. Error: "Could not create search"

lavanyaanne — Tue, 04 Aug 2015 05:39:57 GMT

plz refer splunk Doc http://docs.splunk.com/Documentation/Splunk/6.2.4/AdvancedDev/PostProcess
there may be some limitations in display the result of post process search

Re: Unable to populate dropdown dynamically using PostProcess Search. Error: "Could not create search"

ishangajera — Tue, 04 Aug 2015 06:23:37 GMT

Thanks Lavanya.

That data limitation is only when post-process is search on non-transforming base search.

In my case, I have used stats command in base search which transforms the data and so there should be no data limitation in post-process search.
Also my csv contains only 2 records and only one distinct artist name so data must not be the issue.

Re: Unable to populate dropdown dynamically using PostProcess Search. Error: "Could not create search"

ishangajera — Tue, 04 Aug 2015 06:25:41 GMT

Hey Thanks! That solved my issue.

By adding submitButton="true" in fieldset, got the post process to work.

If you find the reason why that is required, please let me know.

Re: Unable to populate dropdown dynamically using PostProcess Search. Error: "Could not create search"

gcato — Tue, 04 Aug 2015 21:15:20 GMT

Hi Ishangajera,

In regards to 10k data limitation for post-search, my understanding (from reading the documentation) is that transforming commands do not remove this limitation; it's simply a way to reduce the amount of _raw data to hopefully less than 10k. I've not actually tested this, so I could be wrong. Maybe I'll give it a go if I get some time.