Dashboards & Visualizations

Dropdown - how to keep duplicate values

cornemrc
Explorer

Hello,

I am using a dropdown with a dynamic option search

 

| inputlookup serverlocations.csv

 

field for Label: locationname
field for Value: servername

 

The serverlocations.csv looks like this in a regular splunk search:

locationnameservername
UK-Londonserver1.example.com
DE-Berlinserver1.example.com
US-NewYorkserver2.example.com

 

The problem is my dropdown shows only the Labels UK-London and US-NewYork. It removes DE-Berlin from the dropdown as if my search would be

 

| inputlookup serverlocations.csv
| dedup servername

 

But actually I want all three locationnames in my dropdown. I am totally fine if I get the same search results on the dashboards then, because both are using the same servername. I do not understand why splunk is handling my search with a dedup, especially because my search result is looking good as long as it is not used by the dropdown.

Do you have a reason for that behaviour or can you tell me how to avoid that?

Labels (1)
1 Solution

niketn
Legend

@cornemrc try something like the following. SPL is used to create servername as delimited string after combining servername with locationname. Using <eval> to split the servername set the tokens servername and location name using $label$ on <change> of input value.

 

    <input type="dropdown" token="serverlocation">
      <label>Server/Location</label>
      <fieldForLabel>locationname</fieldForLabel>
      <fieldForValue>servername</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>| inputlookup serverlocations.csv
| fields servername locationname
| eval servername=servername."|".locationname</query>
      </search>
      <change>
        <eval token="servername">mvindex(split($value$,"|"),0)</eval>
        <set token="locationname">$label$</set>
      </change>
    </input>

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@cornemrc try something like the following. SPL is used to create servername as delimited string after combining servername with locationname. Using <eval> to split the servername set the tokens servername and location name using $label$ on <change> of input value.

 

    <input type="dropdown" token="serverlocation">
      <label>Server/Location</label>
      <fieldForLabel>locationname</fieldForLabel>
      <fieldForValue>servername</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>| inputlookup serverlocations.csv
| fields servername locationname
| eval servername=servername."|".locationname</query>
      </search>
      <change>
        <eval token="servername">mvindex(split($value$,"|"),0)</eval>
        <set token="locationname">$label$</set>
      </change>
    </input>

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...