How do I make a dropdown dynamic based on a feed/search.

[HattrickNZ]

How do I write this so that it is dynamic based on the search that is done. That is the search will populate my choices based on the data that is available. So if threre is only subrack 0,1 and 2 then the dropdown would have All, 0, 1, 2. But then if threre is only subrack 0, and 1 then the dropdown would have All, 0, 1. This would make the dropdown more dynamic controlled by the search.

 <input type="dropdown" token="subrack_No">
    <label>subrack_No:</label>
    <choice value="*">All</choice>
    <choice value="0">0</choice>
    <choice value="1">1</choice>
    <choice value="2">2</choice>
    <choice value="3">3</choice>
    <choice value="4">4</choice>
    <default>*</default>
  </input>

example of a search :

index=core ..... | stats values(subrack_No)

[_jgpm_]

I did something very similar to this but my concept was based on 2 dropdowns. The first one does a

|inputcsv foo.csv

and then the user selects the value where the fieldlabel/fieldvalue gets assigned to the token $test

the next dropdown does

|inputcsv foo2.csv | search tag="$test$"

which then filters down foo2.csv to only show the tags related to the value selected in the dropdown. The selection sets the token $Choice. This works fine.

I wasn't able to make a third dropdown work.

[stephanefotso · Accepted solution]

Here you go

<input type="dropdown" token="subrack_No">
 <label>subrack_No:</label>
      <choice value="*">All</choice>
      <populatingSearch fieldForLabel="subrack_No" fieldForValue="subrack_No"> index=core ..... | stats count by subrack_No </populatingSearch>
      <default>*</default>
    </input>

Or this, only with splunk 6.2 and more

      <input type="dropdown" token="subrack_No">
  <label>subrack_No:</label>
          <choice value="*">All</choice>
          <search>
            <query> index=core ..... | stats count by subrack_No</query>
          </search>
          <default>*</default>
          <fieldForLabel>subrack_No</fieldForLabel>
          <fieldForValue>subrack_No</fieldForValue>
        </input>

[HattrickNZ]

index=core ...| stats count by subrackNo this search gives me a 2 column result, subrackNo and count.

so when I put this search in the dropdown when the dashboard loads, the dropdown does not fill, under the dropdown it says

> Duplicate labels causing conflict

For clarification as I may not have been clear: the field that has the values I want to fill the dropdown is called subrackNo and not subrack_No, if that makes a difference. this is why my search in the dropdown should look like index=core ...| stats count by subrackNo

I also tried using
index=core ...| stats values(subrackNo) to fill the dropdown but it does not fill it.

[stephanefotso]

Ok! Means also your field for Label and Field for Value must be modified! Here you go

    <input type="dropdown" token="subrack_No">
   <label>subrack_No:</label>
           <choice value="*">All</choice>
           <search>
             <query> index=core ..... | stats count by subrackNo</query>
           </search>
           <default>*</default>
           <fieldForLabel>subrackNo</fieldForLabel>
           <fieldForValue>subrackNo</fieldForValue>
         </input>

[HattrickNZ]

ah thanks the field name goes in here

<fieldForLabel>subrackNo</fieldForLabel>
<fieldForValue>subrackNo</fieldForValue>

I thought it should be the token name.

[HattrickNZ]

Interesting how this gives only 1 value in the dropdown of somwthing like, 0,1,2,3
index=core ... | stats values(subrackNo) as subrackNo

[stephanefotso]

you have several ways to do it, depend on you

index=core ... | stats values(subrackNo) as subrackNo|head 1

index=core ... | stats first(subrackNo) as subrackNo

index=core ... | stats values(subrackNo) as subrackNo|where subrakNo=1

etc...