Dashboards & Visualizations

How do I populate a multi select input element with field names only?

BobKimata
Path Finder

Hi guys,
I am running a search based on an SQL query. I would like to extract field names only from the search and populate a multi select input element with all the field names from a table. A user will then select which fields they want to view on a table on another panel. Am trying to achieve a situation where someone can add and remove columns on a table below. Please assist as I am completely stuck.

Thanks

Tags (1)
0 Karma
1 Solution

BobKimata
Path Finder

Hey guys

I managed to find a solution to to it after chewing on it for a while. Its actually quite a simple procedure:

To get the fieldnames for any given search I used this:

<my search> | stats dc() as *

This will give you a single row with one column for every field, where the cell values are the distinct counts. It creates a table on the fly. To flip the table around:

<my search> | stats dc() as *  | transpose

This creates a table with a single column called 'column' that contains a list of all field names.
From this table I populated the multiselect element using this table by setting the required parameters ie the column name. This table is invisible. However to view it, for checking purposes you will need to create a panel for it. Anyway the code worked for me.

<input type="multiselect" token="sourcetype" searchWhenChanged="true">
       <label>Click to Add / Remove Columns</label>
       <populatingSearch fieldForValue="column" fieldForLabel="column"> | dbquery  "select * from performance" | stats dc() as * | transpose</populatingSearch> 
       <fieldForLabel>sourcetype</fieldForLabel>
       <fieldForValue>sourcetype</fieldForValue>
       <prefix>(</prefix>
       <suffix>)</suffix>
       <valuePrefix>sourcetype="</valuePrefix>
       <valueSuffix>"</valueSuffix>
       <delimiter>OR</delimiter>
       <choice value="*">All</choice>
       <default>*</default>
     </input>

Cheers

View solution in original post

BobKimata
Path Finder

Hey guys

I managed to find a solution to to it after chewing on it for a while. Its actually quite a simple procedure:

To get the fieldnames for any given search I used this:

<my search> | stats dc() as *

This will give you a single row with one column for every field, where the cell values are the distinct counts. It creates a table on the fly. To flip the table around:

<my search> | stats dc() as *  | transpose

This creates a table with a single column called 'column' that contains a list of all field names.
From this table I populated the multiselect element using this table by setting the required parameters ie the column name. This table is invisible. However to view it, for checking purposes you will need to create a panel for it. Anyway the code worked for me.

<input type="multiselect" token="sourcetype" searchWhenChanged="true">
       <label>Click to Add / Remove Columns</label>
       <populatingSearch fieldForValue="column" fieldForLabel="column"> | dbquery  "select * from performance" | stats dc() as * | transpose</populatingSearch> 
       <fieldForLabel>sourcetype</fieldForLabel>
       <fieldForValue>sourcetype</fieldForValue>
       <prefix>(</prefix>
       <suffix>)</suffix>
       <valuePrefix>sourcetype="</valuePrefix>
       <valueSuffix>"</valueSuffix>
       <delimiter>OR</delimiter>
       <choice value="*">All</choice>
       <default>*</default>
     </input>

Cheers

BobKimata
Path Finder

I still haven't got a solution yet. Here is the code that I have tried. There is no error but nothing happens as well.

&lt;input type="multiselect" token="sourcetype" searchWhenChanged="true"&gt;
       &lt;label&gt;Click to Add / Remove Columns&lt;/label&gt;
       &lt;search&gt;
         &lt;query&gt; | dbquery AdWordsROI limit=1000 "select * from account_performance" | stats dc() as * &lt;/query&gt;
       &lt;/search&gt;
       &lt;fieldForLabel&gt;sourcetype&lt;/fieldForLabel&gt;
       &lt;fieldForValue&gt;sourcetype&lt;/fieldForValue&gt;
       &lt;prefix&gt;(&lt;/prefix&gt;
       &lt;suffix&gt;)&lt;/suffix&gt;
       &lt;valuePrefix&gt;sourcetype="&lt;/valuePrefix&gt;
       &lt;valueSuffix&gt;"&lt;/valueSuffix&gt;
       &lt;delimiter&gt;OR&lt;/delimiter&gt;
       &lt;choice value="*"&gt;All&lt;/choice&gt;
       &lt;default&gt;*&lt;/default&gt;
     &lt;/input&gt;

Regards

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...