Hello,
I am using a dropdown with a dynamic option search
| inputlookup serverlocations.csv
field for Label: locationname
field for Value: servername
The serverlocations.csv looks like this in a regular splunk search:
locationname | servername |
UK-London | server1.example.com |
DE-Berlin | server1.example.com |
US-NewYork | server2.example.com |
The problem is my dropdown shows only the Labels UK-London and US-NewYork. It removes DE-Berlin from the dropdown as if my search would be
| inputlookup serverlocations.csv
| dedup servername
But actually I want all three locationnames in my dropdown. I am totally fine if I get the same search results on the dashboards then, because both are using the same servername. I do not understand why splunk is handling my search with a dedup, especially because my search result is looking good as long as it is not used by the dropdown.
Do you have a reason for that behaviour or can you tell me how to avoid that?
@cornemrc try something like the following. SPL is used to create servername as delimited string after combining servername with locationname. Using <eval> to split the servername set the tokens servername and location name using $label$ on <change> of input value.
<input type="dropdown" token="serverlocation">
<label>Server/Location</label>
<fieldForLabel>locationname</fieldForLabel>
<fieldForValue>servername</fieldForValue>
<selectFirstChoice>true</selectFirstChoice>
<search>
<query>| inputlookup serverlocations.csv
| fields servername locationname
| eval servername=servername."|".locationname</query>
</search>
<change>
<eval token="servername">mvindex(split($value$,"|"),0)</eval>
<set token="locationname">$label$</set>
</change>
</input>
@cornemrc try something like the following. SPL is used to create servername as delimited string after combining servername with locationname. Using <eval> to split the servername set the tokens servername and location name using $label$ on <change> of input value.
<input type="dropdown" token="serverlocation">
<label>Server/Location</label>
<fieldForLabel>locationname</fieldForLabel>
<fieldForValue>servername</fieldForValue>
<selectFirstChoice>true</selectFirstChoice>
<search>
<query>| inputlookup serverlocations.csv
| fields servername locationname
| eval servername=servername."|".locationname</query>
</search>
<change>
<eval token="servername">mvindex(split($value$,"|"),0)</eval>
<set token="locationname">$label$</set>
</change>
</input>