All Apps and Add-ons

Pulldown values from PostProcess

Parameshwara
Path Finder
<module name="Search">
    <param name="search">index=aaa | stats count by BBB CCC</param>    
    <module name="PostProcess">
        <param name="search">dedup BBB | fields BBB</param>
        <module name="Pulldown">
            <param name="float">left</param>
            <param name="name">BBBList</param>
            <param name="label">BBB List</param>
            <param name="staticFieldsToDisplay">
            <list>
                <param name="label"></param>
                <param name="value"></param>
            </list>
            </param>
                <param name="searchFieldsToDisplay">
                <list>
                    <param name="label">BBB</param>
                    <param name="value">BBB</param>
                </list>
            </param>
        </module> <!-- End Pulldown -->
    </module> <!-- End PostProcess -->
</module> <!-- End Search -->

The pulldown lists all the BBB field items rather than what I've specified in the postprocess. Why?

0 Karma

sideview
SplunkTrust
SplunkTrust

I'm definitely missing something. The Pulldown lists all the values of the BBB field because that's exactly what you have specified in the PostProcess.

With a base search of

index=aaa | stats count by BBB CCC

and a postprocess search of

dedup BBB | fields BBB

and a searchFieldsToDisplay param on your Pulldown specifying that both option values and option labels should be pulled from the values of BBB - the Pulldown will indeed be rendering the distinct values of BBB as its options.

Can you elaborate on what you expect it to do instead?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Meet the .conf26 AI Agent Buildathon Winners

At the .conf26 AI Agent Buildathon, Splunk users turned their operational expertise into working AI agents ...

Trusted Autonomy in the SOC: A Maturity Journey

AI is compressing attacker timelines and pushing SOC teams beyond human capacity thresholds. The next SOC ...

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...