Dashboards & Visualizations

How do I populate a multi select input element with field names only?

BobKimata
Path Finder

Hi guys,
I am running a search based on an SQL query. I would like to extract field names only from the search and populate a multi select input element with all the field names from a table. A user will then select which fields they want to view on a table on another panel. Am trying to achieve a situation where someone can add and remove columns on a table below. Please assist as I am completely stuck.

Thanks

Tags (1)
0 Karma
1 Solution

BobKimata
Path Finder

Hey guys

I managed to find a solution to to it after chewing on it for a while. Its actually quite a simple procedure:

To get the fieldnames for any given search I used this:

<my search> | stats dc() as *

This will give you a single row with one column for every field, where the cell values are the distinct counts. It creates a table on the fly. To flip the table around:

<my search> | stats dc() as *  | transpose

This creates a table with a single column called 'column' that contains a list of all field names.
From this table I populated the multiselect element using this table by setting the required parameters ie the column name. This table is invisible. However to view it, for checking purposes you will need to create a panel for it. Anyway the code worked for me.

<input type="multiselect" token="sourcetype" searchWhenChanged="true">
       <label>Click to Add / Remove Columns</label>
       <populatingSearch fieldForValue="column" fieldForLabel="column"> | dbquery  "select * from performance" | stats dc() as * | transpose</populatingSearch> 
       <fieldForLabel>sourcetype</fieldForLabel>
       <fieldForValue>sourcetype</fieldForValue>
       <prefix>(</prefix>
       <suffix>)</suffix>
       <valuePrefix>sourcetype="</valuePrefix>
       <valueSuffix>"</valueSuffix>
       <delimiter>OR</delimiter>
       <choice value="*">All</choice>
       <default>*</default>
     </input>

Cheers

View solution in original post

BobKimata
Path Finder

Hey guys

I managed to find a solution to to it after chewing on it for a while. Its actually quite a simple procedure:

To get the fieldnames for any given search I used this:

<my search> | stats dc() as *

This will give you a single row with one column for every field, where the cell values are the distinct counts. It creates a table on the fly. To flip the table around:

<my search> | stats dc() as *  | transpose

This creates a table with a single column called 'column' that contains a list of all field names.
From this table I populated the multiselect element using this table by setting the required parameters ie the column name. This table is invisible. However to view it, for checking purposes you will need to create a panel for it. Anyway the code worked for me.

<input type="multiselect" token="sourcetype" searchWhenChanged="true">
       <label>Click to Add / Remove Columns</label>
       <populatingSearch fieldForValue="column" fieldForLabel="column"> | dbquery  "select * from performance" | stats dc() as * | transpose</populatingSearch> 
       <fieldForLabel>sourcetype</fieldForLabel>
       <fieldForValue>sourcetype</fieldForValue>
       <prefix>(</prefix>
       <suffix>)</suffix>
       <valuePrefix>sourcetype="</valuePrefix>
       <valueSuffix>"</valueSuffix>
       <delimiter>OR</delimiter>
       <choice value="*">All</choice>
       <default>*</default>
     </input>

Cheers

BobKimata
Path Finder

I still haven't got a solution yet. Here is the code that I have tried. There is no error but nothing happens as well.

&lt;input type="multiselect" token="sourcetype" searchWhenChanged="true"&gt;
       &lt;label&gt;Click to Add / Remove Columns&lt;/label&gt;
       &lt;search&gt;
         &lt;query&gt; | dbquery AdWordsROI limit=1000 "select * from account_performance" | stats dc() as * &lt;/query&gt;
       &lt;/search&gt;
       &lt;fieldForLabel&gt;sourcetype&lt;/fieldForLabel&gt;
       &lt;fieldForValue&gt;sourcetype&lt;/fieldForValue&gt;
       &lt;prefix&gt;(&lt;/prefix&gt;
       &lt;suffix&gt;)&lt;/suffix&gt;
       &lt;valuePrefix&gt;sourcetype="&lt;/valuePrefix&gt;
       &lt;valueSuffix&gt;"&lt;/valueSuffix&gt;
       &lt;delimiter&gt;OR&lt;/delimiter&gt;
       &lt;choice value="*"&gt;All&lt;/choice&gt;
       &lt;default&gt;*&lt;/default&gt;
     &lt;/input&gt;

Regards

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...