Dashboards & Visualizations

How can I create a wildcard for a dropdown menu?

HI Splunker's!

In a dashboard I have a dropdown menu populated from a inputlookup CSV file. I have more then 1500 entries in that table. I want to be able to select a particular choice from the dropdown but also to be able to put a wildcard to get multiple choices from that table.

Example:
Let say that my table contains "transaction code" :
ZGCM01C
ZGCM01L
ZGCM01M
ZGCM02C
ZGCM02L
ZGCM03C ...etc

I want to be able to choose 1 single instance like ZGCM01C or be able to put ZGCM* to get all the choices listed in the example above.

Here I have my search string that given me all the result I have in the table.:
|inputlookup trprod_lookup
| dedup TRPROD
| sort TRPROD
| table TRPROD

To use a wildcard I tried this in a independent search and it work's fine:
|inputlookup trprod_lookup
| dedup TRPROD| sort TRPROD
| table TRPROD | search TRPROD="ZGMC*"

But if I put this in my search from the dropdown menu it does'nt produce any result.
|inputlookup trprod_lookup
| dedup TRPROD| sort TRPROD
| table TRPROD | search TRPROD="$sel_TX$"

Any suggestion?

Thanks!

0 Karma
1 Solution

Builder

Hi @usernamejpblais ,
You cannot generate a wildcard value for a dropdown list, or a multichoice box, or a radio button (at least not with the standard Splunk simple XML format, advanced javascript/html is probably beyond the scope of your question). You can have a text box input that you can take the results from and put a wildcard after it.

You CAN create an static entry that includes a wildcard value in the list of choices.

For your use case, however, I would recommend NOT using a dropdown box because your list of options is very large. Dropdown lists make more sense for lists that are somewhere in the range of a few choices to maybe a couple of dozen. Anything more than that becomes a hassle to search and use.

There are other options. You could split the choices into two options:
First X characters (maybe 3 or 4 in your case) which filters to only items starting with those first 3 or 4 characters, and then a second dropdown that will provide results for all the values that start with the first 4 characters provided in the first box.

I hope this helps.

View solution in original post

0 Karma

Path Finder

Hi usernamejpblais

I don't know if it is exactly what you are looking for, because it's not really flexible, but maybe it's an option to use "choice value" in your picklist:

<input type="dropdown" token="trans_cd" searchWhenChanged="true">
<label>Select a transaction code:</label>
<choice value="ZGMC*">ZGMC*</choice>

0 Karma

Builder

Hi @usernamejpblais ,
You cannot generate a wildcard value for a dropdown list, or a multichoice box, or a radio button (at least not with the standard Splunk simple XML format, advanced javascript/html is probably beyond the scope of your question). You can have a text box input that you can take the results from and put a wildcard after it.

You CAN create an static entry that includes a wildcard value in the list of choices.

For your use case, however, I would recommend NOT using a dropdown box because your list of options is very large. Dropdown lists make more sense for lists that are somewhere in the range of a few choices to maybe a couple of dozen. Anything more than that becomes a hassle to search and use.

There are other options. You could split the choices into two options:
First X characters (maybe 3 or 4 in your case) which filters to only items starting with those first 3 or 4 characters, and then a second dropdown that will provide results for all the values that start with the first 4 characters provided in the first box.

I hope this helps.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

I think you may need to use the Prefix and Suffix to add the quotes around the selected value. The way it is now, it is probably treating $sel_TX$ as a string. In the config for the dropdown, add a " as the prefix and a " as the suffix, then remove from your search around the $sel_TX$.

0 Karma

Motivator

can you share the XML that is the definition of your dropdown?

0 Karma

Influencer

@usernamejpblais your dropdown has the value ZGMC* ? Try search TRPROD=$sel_TX$

0 Karma

Builder

@usernamejpblais

Where is this token $sel_TX$ getting the value from ?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!