Dashboards & Visualizations

How to extract unique values from a column into a drop-down menu?

smhsplunk
Communicator

Trying to extract unique values from a column and display them in the drop-down menu:

index=main source=traffic_information
      | search * traffic_location 
      | fields traffic_location 
      | dedup traffic_location 
      | eval traffic_location=split(traffic_location, " ") 
      | eval field1=mvindex(traffic_location,0) 
      | stats values(field1)

So far I don't see anything, but this works perfectly fine when I use the same command in Splunk search, but in a dashboard, it doesn't work.

Please help.

Thanks

0 Karma

somesoni2
Revered Legend

Your search gives a multivalued field with name 'values(field1)' and you must be selecting 'field1' as fieldForDisplay/fieldForValue. Update the query like this

Updated

index=main source=traffic_information
       | search * traffic_location 
       | stats count by traffic_location      
       | eval traffic_location=mvindex(split(traffic_location, " "),0)
       | stats count by traffic_location      
       | table traffic_location

Now use traffic_location as fieldForDisplay/fieldForValue

0 Karma

smhsplunk
Communicator
  <fieldset submitButton="true" autoRun="true">
    <input type="dropdown" token="field1">

      <search>
        <query>index=main source=traffic_information
      | search * traffic_location 
      | stats count by traffic_location 
      | eval field1=mvindex(split(traffic_location," "),0)
      | dedup field1
      | table field1</query>
      </search>
        <fieldsForLabel>field1</fieldsForLabel>
      <fieldsForValue>field1</fieldsForValue>
        </input>

      </fieldset>

  Still shows duplicate values causing conflicts, no data.

somesoni2
Revered Legend

try the updated answer

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...