Dashboards & Visualizations

How to extract unique values from a column into a drop-down menu?

smhsplunk
Communicator

Trying to extract unique values from a column and display them in the drop-down menu:

index=main source=traffic_information
      | search * traffic_location 
      | fields traffic_location 
      | dedup traffic_location 
      | eval traffic_location=split(traffic_location, " ") 
      | eval field1=mvindex(traffic_location,0) 
      | stats values(field1)

So far I don't see anything, but this works perfectly fine when I use the same command in Splunk search, but in a dashboard, it doesn't work.

Please help.

Thanks

0 Karma

somesoni2
Revered Legend

Your search gives a multivalued field with name 'values(field1)' and you must be selecting 'field1' as fieldForDisplay/fieldForValue. Update the query like this

Updated

index=main source=traffic_information
       | search * traffic_location 
       | stats count by traffic_location      
       | eval traffic_location=mvindex(split(traffic_location, " "),0)
       | stats count by traffic_location      
       | table traffic_location

Now use traffic_location as fieldForDisplay/fieldForValue

0 Karma

smhsplunk
Communicator
  <fieldset submitButton="true" autoRun="true">
    <input type="dropdown" token="field1">

      <search>
        <query>index=main source=traffic_information
      | search * traffic_location 
      | stats count by traffic_location 
      | eval field1=mvindex(split(traffic_location," "),0)
      | dedup field1
      | table field1</query>
      </search>
        <fieldsForLabel>field1</fieldsForLabel>
      <fieldsForValue>field1</fieldsForValue>
        </input>

      </fieldset>

  Still shows duplicate values causing conflicts, no data.

somesoni2
Revered Legend

try the updated answer

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...