topic Re: Populate dropdown form field values from a file in Splunk Search

Populate dropdown form field values from a file

sranga — Wed, 28 Apr 2010 02:43:04 GMT

I was wondering if its possible to populate the values for a dropdown field of a form from a file through a lookup command.

The current setup uses the populatingSearch feature and it is very slow. I don't want to add all of the values to the form field as <choice> tags.

Thanks for your help.

Ranga

Re: Populate dropdown form field values from a file

gkanapathy — Wed, 28 Apr 2010 04:01:27 GMT

You can use the | inputlookup command to get the contents of a lookup file into your populatingSearch

Re: Populate dropdown form field values from a file

sranga — Wed, 28 Apr 2010 05:23:03 GMT

Thanks. Is this faster than a | savedsearch?

Re: Populate dropdown form field values from a file

Johnvey — Wed, 28 Apr 2010 05:33:47 GMT

Generally, yes. The inputlookup, at its simplest, just reads lines in from a CSV file so it's about as fast as it gets. Savedsearch can be just as fast if there is a previously scheduled job artifact available -- otherwise a new search will be kicked off.

Re: Populate dropdown form field values from a file

sideview — Wed, 28 Apr 2010 14:32:47 GMT

Yes this is possible and its a great way to do it.

Assuming you're working with a simplified XML view, (ie where your outer tag is <form>), its extremely easy. It's really just a matter of using the inputlookup command in the element.

See here for general discussion of how to configure a pulldown that gets its values from any search. and just picture the search in question starting with the inputlookup command. http://www.splunk.com/base/Documentation/latest/Developer/AddDropDowns

As always, remember to test out the search commands in the search UI to make sure you understand what it's doing and that the fields are coming out right.

Also, if you're using the advanced XML already, the developer manual actually has an example written up about this topic specifically:

http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/LookupsAndViews

Re: Populate dropdown form field values from a file

ChrisG — Fri, 21 Dec 2012 22:54:14 GMT

The updated doc location for creating dropdowns in Splunk 5.0 is http://docs.splunk.com/Documentation/Splunk/5.0/Viz/Exampleform#Create_a_dynamic_form_search_using_drop-downs