topic Is there a upper limit to dashboard dropdown value fetch from lookup file in Splunk Search

Is there a upper limit to dashboard dropdown value fetch from lookup file

manas — Mon, 05 Feb 2024 22:14:04 GMT

I have a lookup file . It has 2 columns : Service and Entity and 500+ rows. Service has 34 unique values and Entity has 164.

I have a dashboard where for search i want to use values from this lookup as input to search criteria. I have following logic .I get the dropdown values for "service" without any issues but not for "entity" when it's same lookup file ,same logic.

Any ideas ?

Snippet :

<input type="dropdown" token="Service" searchWhenChanged="true"> <label>Service</label> <search> <query> |inputlookup metadata.csv | dedup service | stats dc(service) by service </query> </search> <choice value="*">*</choice> <default>*</default> <initialValue>*</initialValue> </input> <input type="dropdown" token="Entity" searchWhenChanged="true"> <label>Entity</label> <search> <query> |inputlookup metadata.csv | dedup entity | stats dc(entity) by entity </query> </search> <choice value="*">*</choice> <default>*</default> <initialValue>*</initialValue> </input>

Re: Is there a upper limit to dashboard dropdown value fetch from lookup file

manas — Mon, 05 Feb 2024 22:21:35 GMT

Or is it possible that issue is related to same lookup file being referenced for next input dropdown subsequently causing issue.

Re: Is there a upper limit to dashboard dropdown value fetch from lookup file

gcusello — Tue, 06 Feb 2024 07:51:43 GMT

Hi @manas,

at first you culd simplify your searches:

e.g. the first:

| inputlookup metadata.csv | dedup service | sort service | table service

then in the second dropdown you could use the result of the first to filter results in this way:

<input type="dropdown" token="Service" searchWhenChanged="true"> <label>Service</label> <search> <query> | inputlookup metadata.csv | dedup service | sort service | table service </query> </search> <choice value="*">*</choice> <default>*</default> <initialValue>*</initialValue> </input> <input type="dropdown" token="Entity" searchWhenChanged="true"> <label>Entity</label> <search> <query> | inputlookup metadata.csv WHERE Service="$Service$" | dedup entity | sort entity | table entity </query> </search> <choice value="*">*</choice> <default>*</default> <initialValue>*</initialValue> </input>

Ciao.

Giuseppe

Re: Is there a upper limit to dashboard dropdown value fetch from lookup file

gcusello — Thu, 08 Feb 2024 07:16:15 GMT

Hi @manas,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉