All Apps and Add-ons

Populating drop down from lookup table

ahogbin
Communicator

Hello..

I am attempting to use a lookup table to populate a drop down box which will then be used to feed into a search. The lookup table has 3 columns one of which is titled BROKER


| inputlookup Safire_Broker.csv | dedup BROKER

  <module name="Pulldown">
    <param name="name">BROKER</param>
    <param name="label">Broker Name:</param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="value">$name$</param>
      </list>
    </param>
  </module>
</module>

The problem that am having is that the drop down does not seem to be recognising the search and all that I get is a drop down box that "loading".

I have verified that the file name is correct using the search | inputlookup Safire_Broker.csv and the table returned is correct

For whatever reason it would appear that my dashboard drop down is not recognising the lookup table and I am at a loss as to know why.

If I use the standard xml search




*
Any


| inputlookup Safire_Broker.csv | dedup BROKER

BROKERS
BROKER_setting
False


BROKER
BROKER


All works as expected... I am puzzled as to why the first query does not work yet the second works perfectly. I must be missing something but cannot for the life of me figure out what.

1 Solution

sideview
SplunkTrust
SplunkTrust

You just need to put an autoRun="True" onto that initial Search module. That will kick off the cascading push, which will cause the search to be dispatched, which then causes the Pulldown to render.

With a Table module you sort of expect it to sit there and not render with no autoRun="True". With a Pulldown people often have the opposite expectation, but all of the Sideview modules behave that way - without some user-initiated push (like clicking a green button or hitting return in a TextField), or a autoRun="True" push from somewhere upstream, it'll all just sit there.

View solution in original post

sideview
SplunkTrust
SplunkTrust

You just need to put an autoRun="True" onto that initial Search module. That will kick off the cascading push, which will cause the search to be dispatched, which then causes the Pulldown to render.

With a Table module you sort of expect it to sit there and not render with no autoRun="True". With a Pulldown people often have the opposite expectation, but all of the Sideview modules behave that way - without some user-initiated push (like clicking a green button or hitting return in a TextField), or a autoRun="True" push from somewhere upstream, it'll all just sit there.

ahogbin
Communicator

Perfect.. I cannot believe it was something so simple 🙂

Thank you as always for your help.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...