Dashboards & Visualizations

Cascading Splunk dropdown will not populate on the first selection but will on the second?

smashedpumpkins
Explorer

Hey folks, I hope you can help me out as I'm stumped. I have a cascading dropdown menu. The 2nd dropdown menu relies on the first to obtain its variables. When I load the page, the first dropdown menu populates with no issue. When I make a selection with the first dropdown menu the second dropdown menu does not populate. If I select a different item in the first dropdown menu, after having already made my first selection, the second dropdown menu populates just fine. It does not matter which item I select in the first drop down menu, the issue always occurs.

<input type="dropdown" token="UCID">
  <label>Select Item</label>
  <default>Default Item 1</default>
  <populatingSearch fieldForValue="UCID" fieldForLabel="UCID">
    <![CDATA[|inputlookup item_1_lookup | fields "Use Case" | rename "Use Case" AS "UCID" | uniq "UCID" | sort "UCID"]]>
  </populatingSearch>
</input>
<input type="dropdown" token="FNAME">
  <label>Select Sub-item</label>
  <default>*</default>
  <populatingSearch fieldForValue="FNAME" fieldForLabel="FNAME">
    <![CDATA[|inputlookup item_1_lookup | search "Use Case"="$UCID$" | fields "Field Name" | rename "Field Name" AS "FNAME" | sort "FNAME"]]>
  </populatingSearch>
</input>
Tags (2)
0 Karma
1 Solution

smashedpumpkins
Explorer

I finally managed to fix it. The default value for the first dropdown menu was no longer located in the lookup table. Once I removed the default value it worked normally again. Sounds like a Splunk bug.

View solution in original post

0 Karma

smashedpumpkins
Explorer

I finally managed to fix it. The default value for the first dropdown menu was no longer located in the lookup table. Once I removed the default value it worked normally again. Sounds like a Splunk bug.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...