Dashboard Studio Dynamic Dropdown Input - Query Types

[shocko]

Using Splunk Enterprise 9. I'm trying to populate a dashboard studio dropdown input from query results. I was testing via a simple query (copied from the dashboard studio examples) as follows:

| inputlookup firewall_example.csv
| stats count by host

This works fine and the dropdown gets populated with the hosts. However, I'd also expected the following to to work 

| inputlookup firewall_example.csv
| stats values(host)

but it doesn't and no dynamic entries are in the dropdown. 

So my understanding of the query types that can be used with dropdown inputs is incomplete! Can someone point me in the right direction? 

[ITWhisperer · Accepted solution]

stats values(host) will give you a multi-value field i.e. a single event, whereas, in order to dynamically populate the dropdown, you need separate events (which is what stats count by host does for you).

[shocko]

Thanks for taking the time to reply @ITWhisperer . Much appreciated. That makes perfect sense.