Dashboards & Visualizations

Dropdown - how to keep duplicate values

cornemrc
Engager

Hello,

I am using a dropdown with a dynamic option search

 

| inputlookup serverlocations.csv

 

field for Label: locationname
field for Value: servername

 

The serverlocations.csv looks like this in a regular splunk search:

locationnameservername
UK-Londonserver1.example.com
DE-Berlinserver1.example.com
US-NewYorkserver2.example.com

 

The problem is my dropdown shows only the Labels UK-London and US-NewYork. It removes DE-Berlin from the dropdown as if my search would be

 

| inputlookup serverlocations.csv
| dedup servername

 

But actually I want all three locationnames in my dropdown. I am totally fine if I get the same search results on the dashboards then, because both are using the same servername. I do not understand why splunk is handling my search with a dedup, especially because my search result is looking good as long as it is not used by the dropdown.

Do you have a reason for that behaviour or can you tell me how to avoid that?

Labels (1)
1 Solution

niketnilay
Legend

@cornemrc try something like the following. SPL is used to create servername as delimited string after combining servername with locationname. Using <eval> to split the servername set the tokens servername and location name using $label$ on <change> of input value.

 

    <input type="dropdown" token="serverlocation">
      <label>Server/Location</label>
      <fieldForLabel>locationname</fieldForLabel>
      <fieldForValue>servername</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>| inputlookup serverlocations.csv
| fields servername locationname
| eval servername=servername."|".locationname</query>
      </search>
      <change>
        <eval token="servername">mvindex(split($value$,"|"),0)</eval>
        <set token="locationname">$label$</set>
      </change>
    </input>

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketnilay
Legend

@cornemrc try something like the following. SPL is used to create servername as delimited string after combining servername with locationname. Using <eval> to split the servername set the tokens servername and location name using $label$ on <change> of input value.

 

    <input type="dropdown" token="serverlocation">
      <label>Server/Location</label>
      <fieldForLabel>locationname</fieldForLabel>
      <fieldForValue>servername</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>| inputlookup serverlocations.csv
| fields servername locationname
| eval servername=servername."|".locationname</query>
      </search>
      <change>
        <eval token="servername">mvindex(split($value$,"|"),0)</eval>
        <set token="locationname">$label$</set>
      </change>
    </input>

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!