All Apps and Add-ons

Populating drop down from lookup table

ahogbin
Communicator

Hello..

I am attempting to use a lookup table to populate a drop down box which will then be used to feed into a search. The lookup table has 3 columns one of which is titled BROKER


| inputlookup Safire_Broker.csv | dedup BROKER

  <module name="Pulldown">
    <param name="name">BROKER</param>
    <param name="label">Broker Name:</param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="value">$name$</param>
      </list>
    </param>
  </module>
</module>

The problem that am having is that the drop down does not seem to be recognising the search and all that I get is a drop down box that "loading".

I have verified that the file name is correct using the search | inputlookup Safire_Broker.csv and the table returned is correct

For whatever reason it would appear that my dashboard drop down is not recognising the lookup table and I am at a loss as to know why.

If I use the standard xml search




*
Any


| inputlookup Safire_Broker.csv | dedup BROKER

BROKERS
BROKER_setting
False


BROKER
BROKER


All works as expected... I am puzzled as to why the first query does not work yet the second works perfectly. I must be missing something but cannot for the life of me figure out what.

1 Solution

sideview
SplunkTrust
SplunkTrust

You just need to put an autoRun="True" onto that initial Search module. That will kick off the cascading push, which will cause the search to be dispatched, which then causes the Pulldown to render.

With a Table module you sort of expect it to sit there and not render with no autoRun="True". With a Pulldown people often have the opposite expectation, but all of the Sideview modules behave that way - without some user-initiated push (like clicking a green button or hitting return in a TextField), or a autoRun="True" push from somewhere upstream, it'll all just sit there.

View solution in original post

sideview
SplunkTrust
SplunkTrust

You just need to put an autoRun="True" onto that initial Search module. That will kick off the cascading push, which will cause the search to be dispatched, which then causes the Pulldown to render.

With a Table module you sort of expect it to sit there and not render with no autoRun="True". With a Pulldown people often have the opposite expectation, but all of the Sideview modules behave that way - without some user-initiated push (like clicking a green button or hitting return in a TextField), or a autoRun="True" push from somewhere upstream, it'll all just sit there.

ahogbin
Communicator

Perfect.. I cannot believe it was something so simple 🙂

Thank you as always for your help.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...