All Apps and Add-ons

Populating drop down from lookup table

ahogbin
Communicator

Hello..

I am attempting to use a lookup table to populate a drop down box which will then be used to feed into a search. The lookup table has 3 columns one of which is titled BROKER


| inputlookup Safire_Broker.csv | dedup BROKER

  <module name="Pulldown">
    <param name="name">BROKER</param>
    <param name="label">Broker Name:</param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="value">$name$</param>
      </list>
    </param>
  </module>
</module>

The problem that am having is that the drop down does not seem to be recognising the search and all that I get is a drop down box that "loading".

I have verified that the file name is correct using the search | inputlookup Safire_Broker.csv and the table returned is correct

For whatever reason it would appear that my dashboard drop down is not recognising the lookup table and I am at a loss as to know why.

If I use the standard xml search




*
Any


| inputlookup Safire_Broker.csv | dedup BROKER

BROKERS
BROKER_setting
False


BROKER
BROKER


All works as expected... I am puzzled as to why the first query does not work yet the second works perfectly. I must be missing something but cannot for the life of me figure out what.

1 Solution

sideview
SplunkTrust
SplunkTrust

You just need to put an autoRun="True" onto that initial Search module. That will kick off the cascading push, which will cause the search to be dispatched, which then causes the Pulldown to render.

With a Table module you sort of expect it to sit there and not render with no autoRun="True". With a Pulldown people often have the opposite expectation, but all of the Sideview modules behave that way - without some user-initiated push (like clicking a green button or hitting return in a TextField), or a autoRun="True" push from somewhere upstream, it'll all just sit there.

View solution in original post

sideview
SplunkTrust
SplunkTrust

You just need to put an autoRun="True" onto that initial Search module. That will kick off the cascading push, which will cause the search to be dispatched, which then causes the Pulldown to render.

With a Table module you sort of expect it to sit there and not render with no autoRun="True". With a Pulldown people often have the opposite expectation, but all of the Sideview modules behave that way - without some user-initiated push (like clicking a green button or hitting return in a TextField), or a autoRun="True" push from somewhere upstream, it'll all just sit there.

ahogbin
Communicator

Perfect.. I cannot believe it was something so simple 🙂

Thank you as always for your help.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...