All Apps and Add-ons

Pulldown values from PostProcess

Parameshwara
Path Finder
<module name="Search">
    <param name="search">index=aaa | stats count by BBB CCC</param>    
    <module name="PostProcess">
        <param name="search">dedup BBB | fields BBB</param>
        <module name="Pulldown">
            <param name="float">left</param>
            <param name="name">BBBList</param>
            <param name="label">BBB List</param>
            <param name="staticFieldsToDisplay">
            <list>
                <param name="label"></param>
                <param name="value"></param>
            </list>
            </param>
                <param name="searchFieldsToDisplay">
                <list>
                    <param name="label">BBB</param>
                    <param name="value">BBB</param>
                </list>
            </param>
        </module> <!-- End Pulldown -->
    </module> <!-- End PostProcess -->
</module> <!-- End Search -->

The pulldown lists all the BBB field items rather than what I've specified in the postprocess. Why?

0 Karma

sideview
SplunkTrust
SplunkTrust

I'm definitely missing something. The Pulldown lists all the values of the BBB field because that's exactly what you have specified in the PostProcess.

With a base search of

index=aaa | stats count by BBB CCC

and a postprocess search of

dedup BBB | fields BBB

and a searchFieldsToDisplay param on your Pulldown specifying that both option values and option labels should be pulled from the values of BBB - the Pulldown will indeed be rendering the distinct values of BBB as its options.

Can you elaborate on what you expect it to do instead?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...

Upgrade Prep for 10.4, Network Observability Deep Dives, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...