topic Re: How to edit my XML and search query to automatically populate a drop-down menu? in Splunk Search

How to edit my XML and search query to automatically populate a drop-down menu?

PabloBonilha — Wed, 08 Oct 2014 17:09:08 GMT

Hello, I'm trying to use the xml below to automatically populate a dropdown menu, but any result is returned and the page remains only as "loading...". Please can someone help me improve this query or correct if wrong? Thanks.

    <input type="dropdown" token="customer">
        <choice value="*">All</choice>
        <populatingSearch fieldForValue="customer" fieldForLabel="customer"><![CDATA[ index="my_index" | dedup customerID | stats count by customerID | sort -customerID | table customerID | rename customerID AS customer ]]></populatingSearch>
    </input>

<!-- SELECT CUSTOMER OPERATION -->
    <input type="dropdown" token="operation">
        <choice value="*">All</choice>
        <populatingSearch fieldForValue="operation" fieldForLabel="operation"><![CDATA[ index="my_index" | dedup operationID | stats count by operationID | sort -operationID | table operationID | rename operationID AS operation ]]></populatingSearch>
    </input>

Re: How to edit my XML and search query to automatically populate a drop-down menu?

jitsinha — Thu, 27 Nov 2014 09:04:44 GMT

As per my understading all you want is to populate dropdowns with customerID and operationID. In that case using stats command makes no sense.

Modified query 1: index="my_index" | table customerID | dedup customerID | sort -customerID | rename customerID AS customer

Modified query 2: index="my_index" | table operationID | dedup operationID | sort -operationID | rename operationID AS operation

Re: How to edit my XML and search query to automatically populate a drop-down menu?

btt — Wed, 17 Dec 2014 10:16:51 GMT

Hi, if you have "loading" in your page then, it is not a populate search the problem if not you should have "could not populate the search". Could you send all your xml source code?