Dashboards & Visualizations

Dropdown - how to keep duplicate values

cornemrc
Explorer

Hello,

I am using a dropdown with a dynamic option search

 

| inputlookup serverlocations.csv

 

field for Label: locationname
field for Value: servername

 

The serverlocations.csv looks like this in a regular splunk search:

locationnameservername
UK-Londonserver1.example.com
DE-Berlinserver1.example.com
US-NewYorkserver2.example.com

 

The problem is my dropdown shows only the Labels UK-London and US-NewYork. It removes DE-Berlin from the dropdown as if my search would be

 

| inputlookup serverlocations.csv
| dedup servername

 

But actually I want all three locationnames in my dropdown. I am totally fine if I get the same search results on the dashboards then, because both are using the same servername. I do not understand why splunk is handling my search with a dedup, especially because my search result is looking good as long as it is not used by the dropdown.

Do you have a reason for that behaviour or can you tell me how to avoid that?

Labels (1)
1 Solution

niketn
Legend

@cornemrc try something like the following. SPL is used to create servername as delimited string after combining servername with locationname. Using <eval> to split the servername set the tokens servername and location name using $label$ on <change> of input value.

 

    <input type="dropdown" token="serverlocation">
      <label>Server/Location</label>
      <fieldForLabel>locationname</fieldForLabel>
      <fieldForValue>servername</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>| inputlookup serverlocations.csv
| fields servername locationname
| eval servername=servername."|".locationname</query>
      </search>
      <change>
        <eval token="servername">mvindex(split($value$,"|"),0)</eval>
        <set token="locationname">$label$</set>
      </change>
    </input>

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@cornemrc try something like the following. SPL is used to create servername as delimited string after combining servername with locationname. Using <eval> to split the servername set the tokens servername and location name using $label$ on <change> of input value.

 

    <input type="dropdown" token="serverlocation">
      <label>Server/Location</label>
      <fieldForLabel>locationname</fieldForLabel>
      <fieldForValue>servername</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>| inputlookup serverlocations.csv
| fields servername locationname
| eval servername=servername."|".locationname</query>
      </search>
      <change>
        <eval token="servername">mvindex(split($value$,"|"),0)</eval>
        <set token="locationname">$label$</set>
      </change>
    </input>

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...