Help with Creating a Dynamic Dropdown for Months and Year

[johnward4]

I'm trying to create dropdown menus, one for the Month and another for the Year, that use dynamic options and timepicker 'today' to default to Current Month and Current Year. I have tested that part successfully.

My question is I'm looking to fill the rest of my dropdown menus 'Month' and 'Year' with previous months and years so I can also search historical data. I have been testing using output lookup tables but I don't have a lot of experience using that option and hoping the community has a few possible options to try out.

Testing query :

index=* 
| eval Time=strftime(_time, "%m/%d/%Y %I:%M:%S %p")
| rex field=Time "(?<date_month>\d+)/"
| rex field=Time "(?<date_year>\d{4})"
| dedup date_month
| dedup date_year
| table date_month, date_year
| output date_lookup

[HiroshiSatoh · Accepted solution]

Try this!

| dedup date_month
| dedup date_year
↓
| dedup date_month,date_year

[johnward4]

Thanks @HiroshiSatoh Have you worked with populating dropdown menus dynamically or with lookups before?

[HiroshiSatoh]

It is a sample dynamically setting a dropdown from the event log.

<input type="dropdown" token="yyyymm">
    <label>Target Month</label>
    <populatingSearch fieldForValue="trng" fieldForLabel="yyyymm">
         <![CDATA[source="WinEventLog:System" (EventCode=6005 OR EventCode=6006) | table _time | eval yyyymm=strftime(_time,"%m/%Y")|dedup yyyymm| eval sdate=substr(yyyymm,1,2)+"/01/"+substr(yyyymm,4,4)+":0:0:0" | eval edate=strftime(relative_time(strptime(sdate,"%m/%d/%Y:%H:%M:%S"),"+1month"),"%m/%d/%Y:%H:%M:%S")  |  eval trng="earliest="+sdate+" latest="+edate]]>
    </populatingSearch>
</input>