Dashboards & Visualizations

Dropdown values are not shown

SrinivasaC
Path Finder

My sample file:

State , District , Total Enrolments

Andaman_and_Nicobar_Islands, Andamans,116866>

Andaman_and_Nicobar_Islands, Port_Blair,2

Andhra_Pradesh, Hyderabad,5004246

Andhra_Pradesh, Ananthapur,92

Arunachal_Pradesh, West_Kameng,143

Arunachal_Pradesh, Lohit,77

I have to get State values in dropdown based on selection, District and enrol values have to show.

My advanced XML form shown below:

<?xml version='1.0' encoding='utf-8'?>


<!-- define master search template, with replacement tokens delimited with $ -->
<searchTemplate>index="states_index" series=$series$ | table "District", "Total_Enrolments"</searchTemplate>

<fieldset>
    <!-- Define a simple dropdown form driven by a search -->
    <input type="dropdown" token="series">
        <label>Select State</label>
        <populatingSearch fieldForValue="series" fieldForLabel="series"><![CDATA[index="states_index"  | dedup State | table State | sort +State]]></populatingSearch>
        <choice value="*">Any</choice>
    </input>
</fieldset>

<row>
    <!-- output the results as a 50 row events table -->
    <table>
        <title>Matching events</title>
        <option name="count">50</option>
    </table>
</row>

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

You've left a few things in the XML set to the values from the example, .

The examples all use a "series" field, whereas here you want it to pull from a field called "State".

You've got series=$series$ in your search, when you want to have State="$State$.

You also have token=series, which is what tells the system you want to use $series$ in your searches to identify the token. You want to change that to token="State"

You then have fieldForValue="series" fieldForLabel="series". This tells the dropdown to look for it's values in a field called series, which of course wont be there. Change those both to be State.

View solution in original post

sideview
SplunkTrust
SplunkTrust

You've left a few things in the XML set to the values from the example, .

The examples all use a "series" field, whereas here you want it to pull from a field called "State".

You've got series=$series$ in your search, when you want to have State="$State$.

You also have token=series, which is what tells the system you want to use $series$ in your searches to identify the token. You want to change that to token="State"

You then have fieldForValue="series" fieldForLabel="series". This tells the dropdown to look for it's values in a field called series, which of course wont be there. Change those both to be State.

SrinivasaC
Path Finder

Thanks sideview

0 Karma

SrinivasaC
Path Finder

I can able to get results when I click on search button. but in dropdown, I'm unable to retrieve States.

0 Karma

SrinivasaC
Path Finder

Im Sorry Im working on forms.
Thanks Martin,
I have followed as example given in the Splunk UI Examples(form_dropdown.xml).

0 Karma

martin_mueller
SplunkTrust
SplunkTrust
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...