https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-dynamic-drop-down-with-an-eval-case-statement/m-p/246597#M73514 <P>Use this as dd2 search<BR /> <STRONG>Update - fixed typo</STRONG></P> <PRE><CODE>| gentimes start=-1 | eval values=ase ("$dd1$" == "dd1v1", "dd2v1", "$dd1$" == "dd1v2", "dd2v2",1=1,"Unknown") | table values </CODE></PRE> Thu, 25 Aug 2016 16:45:30 GMT somesoni2 2016-08-25T16:45:30Z https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-dynamic-drop-down-with-an-eval-case-statement/m-p/246596#M73513 <P>Hi! </P> <P>So I have two drop-downs on my dashboard: one with a static list of options (dd1), and a second one which will populate based on the first choice made (dd2). In dd2, I am using the dynamic search option with the token from dd1:</P> <PRE><CODE>eval values = case ( $dd1$ == "dd1v1", "dd2v1", $dd1$ == "dd1v2", "dd2v2") fieldforvalues and fieldforlabels = values </CODE></PRE> <P>The message below dd2 says it is "Populating", but then it continues to do so after a while before stating no results were found. <BR /> Any help, or alternative suggestions to this method would be greatly appreciated.</P> <P>Using Splunk Enterprise 6.4 and Simple XML I believe. Thank you!</P> Thu, 25 Aug 2016 16:36:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-dynamic-drop-down-with-an-eval-case-statement/m-p/246596#M73513 myungjaeyi 2016-08-25T16:36:26Z https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-dynamic-drop-down-with-an-eval-case-statement/m-p/246597#M73514 <P>Use this as dd2 search<BR /> <STRONG>Update - fixed typo</STRONG></P> <PRE><CODE>| gentimes start=-1 | eval values=ase ("$dd1$" == "dd1v1", "dd2v1", "$dd1$" == "dd1v2", "dd2v2",1=1,"Unknown") | table values </CODE></PRE> Thu, 25 Aug 2016 16:45:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-dynamic-drop-down-with-an-eval-case-statement/m-p/246597#M73514 somesoni2 2016-08-25T16:45:30Z https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-dynamic-drop-down-with-an-eval-case-statement/m-p/246598#M73515 <P>Still hitting the same problem. I am pretty new to Splunk, so I'm not sure if this is related, but occasionally, the app will replace $dd1$ with the actual value? Like the search query will change from $dd1$ to dd1v.</P> <P>Also thanks for the quick resposne!</P> Thu, 25 Aug 2016 16:54:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-dynamic-drop-down-with-an-eval-case-statement/m-p/246598#M73515 myungjaeyi 2016-08-25T16:54:48Z https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-dynamic-drop-down-with-an-eval-case-statement/m-p/246599#M73516 <P>So this did the trick but it should be gentimes start = -1</P> <P>However, I am still getting the issue where the token, $dd1$, is being replaced with the actual value in the dynamic search for dd2</P> Thu, 25 Aug 2016 18:26:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-dynamic-drop-down-with-an-eval-case-statement/m-p/246599#M73516 myungjaeyi 2016-08-25T18:26:20Z https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-dynamic-drop-down-with-an-eval-case-statement/m-p/246600#M73517 <P>Everything is now working! I also was able to do a list of results which you will need to append </P> <PRE><CODE>... | makemv values | mvexpand values | table values </CODE></PRE> <P>at the end in order to separate the list into separate values for the field</P> Thu, 25 Aug 2016 19:02:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-dynamic-drop-down-with-an-eval-case-statement/m-p/246600#M73517 myungjaeyi 2016-08-25T19:02:36Z