Add 2 static rows to dropdown search results before sort

basandlin — Wed, 21 Oct 2020 03:01:33 GMT

I am populating dropdown options with the following search. Right now, this is the search.

I am doing some formatting to make my list look like this:

Azure - Global Azure - Central US AWS - Global AWS - ap-northeast-1

However, we would like to add two rows with 'label' fields called "AWS" and "Azure" so that we can style them in CSS to be the labels in a sectioned list like so:

*Azure* Global Central US __________ *AWS* Global ap-northeast-1

any ideas how I could add these 2 rows and have the sort work out to where the labels are at the top?

I have tried to add these choices with appendpipe, but the row appears, then disappears before the search completes.

Re: Add 2 static rows to dropdown search results before sort

bowesmana — Wed, 21 Oct 2020 03:46:42 GMT

@basandlin

Does this example give you what you want?

<form> <label>test_dropdown</label> <fieldset submitButton="false"> <input type="dropdown" token="region_select" searchWhenChanged="true"> <label>Choose Cloud/Region</label> <fieldForLabel>region_label</fieldForLabel> <fieldForValue>region_choice</fieldForValue> <search> <query>| makeresults | eval _raw="cloud,region Azure,Global Azure,Central US AWS,Global AWS,ap-northeast-1" | multikv forceheader=1 | table cloud region | appendpipe [ | stats count by cloud | eval region="!" ] | sort cloud region | eval region_choice=if(region="!","!".cloud."!",cloud."!".region) | eval region_label=if(region="!",cloud,region)</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <change> <condition match="match($region_select$,"^!")"> <unset token="region_chosen"></unset> </condition> <condition match="NOT match($region_select$,"^!")"> <set token="region_chosen">$region_select$</set> </condition> </change> </input> </fieldset> <row rejects="$region_chosen$"> <panel> <html> <h1>No region yet chosen</h1> </html> </panel> </row> <row depends="$region_chosen$"> <panel> <table> <title>Cloud and region chosen from $region_select$ - $region_chosen$</title> <search> <query>| makeresults | eval Choice=$region_chosen|s$ | rex field=Choice "(?<cloud>[^!]+)!(?<region>.*)" | table cloud region</query> <earliest>-15m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form>

topic Re: Add 2 static rows to dropdown search results before sort in Splunk Search

Add 2 static rows to dropdown search results before sort

Re: Add 2 static rows to dropdown search results before sort