Dashboard auto-populate returning no values, yet search does.

[cnicholl]

Attempting to populate a dropdown for a dashboard. The source is a lookup file. CSV. It does have null values in the table for this field, and also the returned data contains spaces and / in some fields.

I am using:
| inputlookup filename.csv | fields "Field Name" | dedup "Field Name"

as the Dynamic search, and the sample search for the lookup does work properly.

But when I run save the dropdown it fails to return any data.

Splunk 7.2.6

[woodcock · Accepted solution]

Spaces in field names are EVIL; I would do this:

| inputlookup filename.csv
| stats count BY "Field Name"
| sort 0 - count
| rename "Field Name" AS field_value
| eval  field_name = field_value . "(" . count . ")"

Then make sure that you specify field_name as the name to use and field_value as the value to use.

[cnicholl]

| inputlookup filename.csv
| stats count BY "Field Name"
| sort 0 - count
| rename "Field Name" AS field_value
| eval field_name = field_value . "(" count . ")"

has some eval error. I removed | eval field_name = field_value . "(" count . ")" and it seems to be working now. Go figure?

[woodcock]

I was missing a .. I fixed my answer AND tested it; it works now. Please come back and click Accept to close the question @cnicholl.

[renjith_nair]

@cnicholl,
Check whether the lookup and dashboard are in the same app context and if not, app which holds the dashboard has permissions to read lookup.
Field for value/Field for label params are configured.
Is it possible to share the drop down part of xml ?

[cnicholl]

  <label>Field Filter</label>
  <fieldForLabel>fieldfilter</fieldForLabel>
  <fieldForValue>fieldfilter</fieldForValue>
  <search>
    <query>| inputlookup fielddata.csv | fields "Field Name" | dedup "Field Name" </query>
    <earliest>-7d@h</earliest>
    <latest>now</latest>
  </search>
  <choice value="*">ALL</choice>
  <default>*</default>
  <initialValue>*</initialValue>
</input>

I've tried "all time" for earliest
I verified that both the dashboard and lookup are in search and the lookup has everyone read.

Hoping this posts with the xml

[cnicholl]

I also adjusted the search to include returned results that did not have any spaces, or the / . Still nada

[renjith_nair]

@cnicholl,
Can you rename "Field Name" to fieldfilter or whatever fieldname you used in fieldForValue?

something similar to

   <label>Field Filter</label>
   <fieldForLabel>fieldfilter</fieldForLabel>
   <fieldForValue>fieldfilter</fieldForValue>
   <search>
     <query>| inputlookup fielddata.csv | fields "Field Name" | dedup "Field Name"|rename  "Field Name" as  fieldfilter</query>
     <earliest>-7d@h</earliest>
     <latest>now</latest>
   </search>
   <choice value="*">ALL</choice>
   <default>*</default>
   <initialValue>*</initialValue>
 </input>