Dashboards & Visualizations

How to extract unique values from a column into a drop-down menu?

smhsplunk
Communicator

Trying to extract unique values from a column and display them in the drop-down menu:

index=main source=traffic_information
      | search * traffic_location 
      | fields traffic_location 
      | dedup traffic_location 
      | eval traffic_location=split(traffic_location, " ") 
      | eval field1=mvindex(traffic_location,0) 
      | stats values(field1)

So far I don't see anything, but this works perfectly fine when I use the same command in Splunk search, but in a dashboard, it doesn't work.

Please help.

Thanks

0 Karma

somesoni2
Revered Legend

Your search gives a multivalued field with name 'values(field1)' and you must be selecting 'field1' as fieldForDisplay/fieldForValue. Update the query like this

Updated

index=main source=traffic_information
       | search * traffic_location 
       | stats count by traffic_location      
       | eval traffic_location=mvindex(split(traffic_location, " "),0)
       | stats count by traffic_location      
       | table traffic_location

Now use traffic_location as fieldForDisplay/fieldForValue

0 Karma

smhsplunk
Communicator
  <fieldset submitButton="true" autoRun="true">
    <input type="dropdown" token="field1">

      <search>
        <query>index=main source=traffic_information
      | search * traffic_location 
      | stats count by traffic_location 
      | eval field1=mvindex(split(traffic_location," "),0)
      | dedup field1
      | table field1</query>
      </search>
        <fieldsForLabel>field1</fieldsForLabel>
      <fieldsForValue>field1</fieldsForValue>
        </input>

      </fieldset>

  Still shows duplicate values causing conflicts, no data.

somesoni2
Revered Legend

try the updated answer

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...