Autosuggest

[TylerJVitale]

I'm creating a dashboard with text inputs. Is there a way to get Splunk to have a dropdown with autosuggestions when the user types in the text box, similar to how it works in the Search and Reporting app?

[renjith_nair · Accepted solution]

@TylerJVitale,

You could use Multiselect input for that where you could load all your possible dataset and when user start typing, the results are popped up. In text box, there are no ways to pre-populate except the default data.

[TylerJVitale]

That seems like it would work. How would I set it up so I could load the dataset i.e. in the input settings what would I have to select/adjust?

[renjith_nair]

Please see a sample dashboard which could be run anywhere

<form>
  <label>Tyler J Vitale</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="sourcetype" searchWhenChanged="true">
      <label>Sourcetype</label>
      <valuePrefix>sourcetype="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_*|stats count by sourcetype</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <prefix>(</prefix>
      <suffix>)</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_* $sourcetype$ |timechart count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">zero</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
      </chart>
    </panel>
  </row>
</form>

[TylerJVitale]

The dashboard keeps freezing every time I try to implement this

[renjith_nair]

Its quite strange, because we are selecting only last 15 mins data. This is a smoothly running dashboard on my mobile device. You need to select a sourcetype in the multiselect to run the dashboard. What about other searches in your environment?

[TylerJVitale]

Other searches in my environment run fine. I think it freezes because there are millions of servers in the database and splunk has difficulty processing all of them into one multiselect input