Attempting to populate a dropdown for a dashboard. The source is a lookup file. CSV. It does have null values in the table for this field, and also the returned data contains spaces and / in some fields.
I am using:
| inputlookup filename.csv | fields "Field Name" | dedup "Field Name"
as the Dynamic search, and the sample search for the lookup does work properly.
But when I run save the dropdown it fails to return any data.
Splunk 7.2.6
Spaces in field names are EVIL; I would do this:
| inputlookup filename.csv
| stats count BY "Field Name"
| sort 0 - count
| rename "Field Name" AS field_value
| eval field_name = field_value . "(" . count . ")"
Then make sure that you specify field_name
as the name to use and field_value
as the value to use.
Spaces in field names are EVIL; I would do this:
| inputlookup filename.csv
| stats count BY "Field Name"
| sort 0 - count
| rename "Field Name" AS field_value
| eval field_name = field_value . "(" . count . ")"
Then make sure that you specify field_name
as the name to use and field_value
as the value to use.
| inputlookup filename.csv
| stats count BY "Field Name"
| sort 0 - count
| rename "Field Name" AS field_value
| eval field_name = field_value . "(" count . ")"
has some eval error. I removed | eval field_name = field_value . "(" count . ")" and it seems to be working now. Go figure?
I was missing a .
. I fixed my answer AND tested it; it works now. Please come back and click Accept
to close the question @cnicholl.
@cnicholl,
Check whether the lookup and dashboard are in the same app context and if not, app which holds the dashboard has permissions to read lookup.
Field for value/Field for label params are configured.
Is it possible to share the drop down part of xml ?
<label>Field Filter</label>
<fieldForLabel>fieldfilter</fieldForLabel>
<fieldForValue>fieldfilter</fieldForValue>
<search>
<query>| inputlookup fielddata.csv | fields "Field Name" | dedup "Field Name" </query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
<choice value="*">ALL</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>
I've tried "all time" for earliest
I verified that both the dashboard and lookup are in search and the lookup has everyone read.
Hoping this posts with the xml
I also adjusted the search to include returned results that did not have any spaces, or the / . Still nada
@cnicholl,
Can you rename "Field Name" to fieldfilter or whatever fieldname you used in fieldForValue?
something similar to
<label>Field Filter</label>
<fieldForLabel>fieldfilter</fieldForLabel>
<fieldForValue>fieldfilter</fieldForValue>
<search>
<query>| inputlookup fielddata.csv | fields "Field Name" | dedup "Field Name"|rename "Field Name" as fieldfilter</query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
<choice value="*">ALL</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>