Dashboards & Visualizations

Dropdown values are not shown

SrinivasaC
Path Finder

My sample file:

State , District , Total Enrolments

Andaman_and_Nicobar_Islands, Andamans,116866>

Andaman_and_Nicobar_Islands, Port_Blair,2

Andhra_Pradesh, Hyderabad,5004246

Andhra_Pradesh, Ananthapur,92

Arunachal_Pradesh, West_Kameng,143

Arunachal_Pradesh, Lohit,77

I have to get State values in dropdown based on selection, District and enrol values have to show.

My advanced XML form shown below:

<?xml version='1.0' encoding='utf-8'?>


<!-- define master search template, with replacement tokens delimited with $ -->
<searchTemplate>index="states_index" series=$series$ | table "District", "Total_Enrolments"</searchTemplate>

<fieldset>
    <!-- Define a simple dropdown form driven by a search -->
    <input type="dropdown" token="series">
        <label>Select State</label>
        <populatingSearch fieldForValue="series" fieldForLabel="series"><![CDATA[index="states_index"  | dedup State | table State | sort +State]]></populatingSearch>
        <choice value="*">Any</choice>
    </input>
</fieldset>

<row>
    <!-- output the results as a 50 row events table -->
    <table>
        <title>Matching events</title>
        <option name="count">50</option>
    </table>
</row>

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

You've left a few things in the XML set to the values from the example, .

The examples all use a "series" field, whereas here you want it to pull from a field called "State".

You've got series=$series$ in your search, when you want to have State="$State$.

You also have token=series, which is what tells the system you want to use $series$ in your searches to identify the token. You want to change that to token="State"

You then have fieldForValue="series" fieldForLabel="series". This tells the dropdown to look for it's values in a field called series, which of course wont be there. Change those both to be State.

View solution in original post

sideview
SplunkTrust
SplunkTrust

You've left a few things in the XML set to the values from the example, .

The examples all use a "series" field, whereas here you want it to pull from a field called "State".

You've got series=$series$ in your search, when you want to have State="$State$.

You also have token=series, which is what tells the system you want to use $series$ in your searches to identify the token. You want to change that to token="State"

You then have fieldForValue="series" fieldForLabel="series". This tells the dropdown to look for it's values in a field called series, which of course wont be there. Change those both to be State.

SrinivasaC
Path Finder

Thanks sideview

0 Karma

SrinivasaC
Path Finder

I can able to get results when I click on search button. but in dropdown, I'm unable to retrieve States.

0 Karma

SrinivasaC
Path Finder

Im Sorry Im working on forms.
Thanks Martin,
I have followed as example given in the Splunk UI Examples(form_dropdown.xml).

0 Karma

martin_mueller
SplunkTrust
SplunkTrust
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...