All Apps and Add-ons

sideview multiple pulldowns



I am trying to use two pull downs. The first based from a search, the second static only. It seems that the second always contains values (sort of) from the first. Can I use two pulldowns in a search module and only have one contain static entries?


<module name="Search" layoutPanel="panel_row2_col1" autoRun="True">
    <param name="search">-- this is my query that populate the pull down --</param>
    <module name="Pulldown">
        <param name="name">selectedowner</param>
        <param name="label">Owner</param>
        <param name="valueField">owner</param>
        <param name="staticOptions">
                <param name="label">All</param>
                <param name="value">%</param>
        <module name ="Search">
            <param name="search"/>
            <module name="Pulldown" >
                <param name="name">timeframe</param>
                <param name="label">Time Frame</param>
                <param name="valueField">timeframe</param>
                <param name="size">2</param>
                <param name="staticOptions">
                        <param name="label">Last 7 days</param>
                        <param name="value">unix_timestamp(now())-(86400*7)</param>
                        <param name="label">Last 30 days</param>
                        <param name="value">unix_timestamp(now())-(86400*30)</param>
                <module name="Search">

The second pull down contains the first two static options, and then "No value found" for every record that the search produces above. I would really like to have this contain only the two static entries. Is that possible?

Tags (2)


You just need to remove the

<param name="valueField">timeframe</param>

param from the second Pulldown. The valueField param is what tell the Pulldown to render dynamic values. So it is looking into the current search results it has, which are of course the same results as it's upstream Pulldown had, and it's looking for a field called "timeframe". There isn't one presumably, so it renders a lot of "(no value found)".

just delete that param and you'll be good to go.

Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...