Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- How can I retrieve another field value from dashbo...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How can I retrieve another field value from dashboard dropdown?
I have an index which consists of 2 fields: name and id. When I created the dropdown, I made it base of name since it is easier for user to identify. But I really need the id as an input for my other searches. I thought I could achieve this by field for label and field for value but it doesn't work. What can I do to get the value of id but doesn't have to create a join for all of my other searches, since I already have a join in my search?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@tamduong16, do you mean to say that your query for dropdown has Name but not id? Even if you currently already have join in your existing search but it does not return Id field values, it would be of no use. Your query would need to return both fields so that Name can be used as Label and Id can be used as Value.
If Name and ID exist in the same index, in order for community members to assist you would need to provide your existing query? Your sample data with Name and Ids respectively (also their field names). And also the correlation between the two fields.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@tamduong16,
field for label and field for value works in this case. Please find below the sample xml
Here I have created 5 sample values with id and name and displayed name in the dropdown and the token is set to corresponding id and then i could use the id token in other searches
<form>
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="id">
<label>Name</label>
<fieldForLabel>name</fieldForLabel>
<fieldForValue>id</fieldForValue>
<search>
<query>| makeresults |eval ids="1,2,3,4,5"|eval names="A,B,C,D,E"| makemv delim="," ids|makemv delim="," names
|eval z=mvzip(ids,names)|table z| mvexpand z|eval x=split(z,",")|eval id=mvindex(x,0),name=mvindex(x,1)|table id,name</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<default>1</default>
<initialValue>1</initialValue>
</input>
</fieldset>
<row>
<html>
<h1 align="center"> Selected id is <font color="red">$id$</font></h1>
</html>
</row>
</form>
What goes around comes around. If it helps, hit it with Karma 🙂
Tech Talk Recap | Mastering Threat Hunting
Observability for AI Applications: Troubleshooting Latency
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
