Dashboards & Visualizations

Dropdown values are not shown

SrinivasaC
Path Finder

My sample file:

State , District , Total Enrolments

Andaman_and_Nicobar_Islands, Andamans,116866>

Andaman_and_Nicobar_Islands, Port_Blair,2

Andhra_Pradesh, Hyderabad,5004246

Andhra_Pradesh, Ananthapur,92

Arunachal_Pradesh, West_Kameng,143

Arunachal_Pradesh, Lohit,77

I have to get State values in dropdown based on selection, District and enrol values have to show.

My advanced XML form shown below:

<?xml version='1.0' encoding='utf-8'?>


<!-- define master search template, with replacement tokens delimited with $ -->
<searchTemplate>index="states_index" series=$series$ | table "District", "Total_Enrolments"</searchTemplate>

<fieldset>
    <!-- Define a simple dropdown form driven by a search -->
    <input type="dropdown" token="series">
        <label>Select State</label>
        <populatingSearch fieldForValue="series" fieldForLabel="series"><![CDATA[index="states_index"  | dedup State | table State | sort +State]]></populatingSearch>
        <choice value="*">Any</choice>
    </input>
</fieldset>

<row>
    <!-- output the results as a 50 row events table -->
    <table>
        <title>Matching events</title>
        <option name="count">50</option>
    </table>
</row>

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

You've left a few things in the XML set to the values from the example, .

The examples all use a "series" field, whereas here you want it to pull from a field called "State".

You've got series=$series$ in your search, when you want to have State="$State$.

You also have token=series, which is what tells the system you want to use $series$ in your searches to identify the token. You want to change that to token="State"

You then have fieldForValue="series" fieldForLabel="series". This tells the dropdown to look for it's values in a field called series, which of course wont be there. Change those both to be State.

View solution in original post

sideview
SplunkTrust
SplunkTrust

You've left a few things in the XML set to the values from the example, .

The examples all use a "series" field, whereas here you want it to pull from a field called "State".

You've got series=$series$ in your search, when you want to have State="$State$.

You also have token=series, which is what tells the system you want to use $series$ in your searches to identify the token. You want to change that to token="State"

You then have fieldForValue="series" fieldForLabel="series". This tells the dropdown to look for it's values in a field called series, which of course wont be there. Change those both to be State.

SrinivasaC
Path Finder

Thanks sideview

0 Karma

SrinivasaC
Path Finder

I can able to get results when I click on search button. but in dropdown, I'm unable to retrieve States.

0 Karma

SrinivasaC
Path Finder

Im Sorry Im working on forms.
Thanks Martin,
I have followed as example given in the Splunk UI Examples(form_dropdown.xml).

0 Karma

martin_mueller
SplunkTrust
SplunkTrust
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us.  The ...

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

The surge in machine data is already hitting enterprise budgets, and the agentic era will only intensify it. ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...