All Apps and Add-ons

Populating drop down from lookup table

ahogbin
Communicator

Hello..

I am attempting to use a lookup table to populate a drop down box which will then be used to feed into a search. The lookup table has 3 columns one of which is titled BROKER


| inputlookup Safire_Broker.csv | dedup BROKER

  <module name="Pulldown">
    <param name="name">BROKER</param>
    <param name="label">Broker Name:</param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="value">$name$</param>
      </list>
    </param>
  </module>
</module>

The problem that am having is that the drop down does not seem to be recognising the search and all that I get is a drop down box that "loading".

I have verified that the file name is correct using the search | inputlookup Safire_Broker.csv and the table returned is correct

For whatever reason it would appear that my dashboard drop down is not recognising the lookup table and I am at a loss as to know why.

If I use the standard xml search




*
Any


| inputlookup Safire_Broker.csv | dedup BROKER

BROKERS
BROKER_setting
False


BROKER
BROKER


All works as expected... I am puzzled as to why the first query does not work yet the second works perfectly. I must be missing something but cannot for the life of me figure out what.

1 Solution

sideview
SplunkTrust
SplunkTrust

You just need to put an autoRun="True" onto that initial Search module. That will kick off the cascading push, which will cause the search to be dispatched, which then causes the Pulldown to render.

With a Table module you sort of expect it to sit there and not render with no autoRun="True". With a Pulldown people often have the opposite expectation, but all of the Sideview modules behave that way - without some user-initiated push (like clicking a green button or hitting return in a TextField), or a autoRun="True" push from somewhere upstream, it'll all just sit there.

View solution in original post

sideview
SplunkTrust
SplunkTrust

You just need to put an autoRun="True" onto that initial Search module. That will kick off the cascading push, which will cause the search to be dispatched, which then causes the Pulldown to render.

With a Table module you sort of expect it to sit there and not render with no autoRun="True". With a Pulldown people often have the opposite expectation, but all of the Sideview modules behave that way - without some user-initiated push (like clicking a green button or hitting return in a TextField), or a autoRun="True" push from somewhere upstream, it'll all just sit there.

ahogbin
Communicator

Perfect.. I cannot believe it was something so simple 🙂

Thank you as always for your help.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...