Dashboards & Visualizations

How can I retrieve another field value from dashboard dropdown?


I have an index which consists of 2 fields: name and id. When I created the dropdown, I made it base of name since it is easier for user to identify. But I really need the id as an input for my other searches. I thought I could achieve this by field for label and field for value but it doesn't work. What can I do to get the value of id but doesn't have to create a join for all of my other searches, since I already have a join in my search?

0 Karma


@tamduong16, do you mean to say that your query for dropdown has Name but not id? Even if you currently already have join in your existing search but it does not return Id field values, it would be of no use. Your query would need to return both fields so that Name can be used as Label and Id can be used as Value.

If Name and ID exist in the same index, in order for community members to assist you would need to provide your existing query? Your sample data with Name and Ids respectively (also their field names). And also the correlation between the two fields.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma



field for label and field for value works in this case. Please find below the sample xml

Here I have created 5 sample values with id and name and displayed name in the dropdown and the token is set to corresponding id and then i could use the id token in other searches

  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="id">
        <query>| makeresults |eval ids="1,2,3,4,5"|eval names="A,B,C,D,E"| makemv delim="," ids|makemv delim="," names
|eval z=mvzip(ids,names)|table z| mvexpand z|eval x=split(z,",")|eval id=mvindex(x,0),name=mvindex(x,1)|table id,name</query>
      <h1 align="center"> Selected id is <font color="red">$id$</font></h1>
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...