All Apps and Add-ons

Pulldown values from PostProcess

Parameshwara
Path Finder
<module name="Search">
    <param name="search">index=aaa | stats count by BBB CCC</param>    
    <module name="PostProcess">
        <param name="search">dedup BBB | fields BBB</param>
        <module name="Pulldown">
            <param name="float">left</param>
            <param name="name">BBBList</param>
            <param name="label">BBB List</param>
            <param name="staticFieldsToDisplay">
            <list>
                <param name="label"></param>
                <param name="value"></param>
            </list>
            </param>
                <param name="searchFieldsToDisplay">
                <list>
                    <param name="label">BBB</param>
                    <param name="value">BBB</param>
                </list>
            </param>
        </module> <!-- End Pulldown -->
    </module> <!-- End PostProcess -->
</module> <!-- End Search -->

The pulldown lists all the BBB field items rather than what I've specified in the postprocess. Why?

0 Karma

sideview
SplunkTrust
SplunkTrust

I'm definitely missing something. The Pulldown lists all the values of the BBB field because that's exactly what you have specified in the PostProcess.

With a base search of

index=aaa | stats count by BBB CCC

and a postprocess search of

dedup BBB | fields BBB

and a searchFieldsToDisplay param on your Pulldown specifying that both option values and option labels should be pulled from the values of BBB - the Pulldown will indeed be rendering the distinct values of BBB as its options.

Can you elaborate on what you expect it to do instead?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Unlocking Unified Insights: New Gigamon Federated Search App for Splunk

In today’s data-heavy environment, organizations are caught in a data distribution dilemma. As data volumes ...

GA: New Data Management App in Splunk Platform

Streamlining Data Management: Introducing a unified experience in Splunk Managing data at scale shouldn’t feel ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...