Dashboards & Visualizations

How to extract unique values from a column into a drop-down menu?

Communicator

Trying to extract unique values from a column and display them in the drop-down menu:

index=main source=traffic_information
      | search * traffic_location 
      | fields traffic_location 
      | dedup traffic_location 
      | eval traffic_location=split(traffic_location, " ") 
      | eval field1=mvindex(traffic_location,0) 
      | stats values(field1)

So far I don't see anything, but this works perfectly fine when I use the same command in Splunk search, but in a dashboard, it doesn't work.

Please help.

Thanks

0 Karma

Revered Legend

Your search gives a multivalued field with name 'values(field1)' and you must be selecting 'field1' as fieldForDisplay/fieldForValue. Update the query like this

Updated

index=main source=traffic_information
       | search * traffic_location 
       | stats count by traffic_location      
       | eval traffic_location=mvindex(split(traffic_location, " "),0)
       | stats count by traffic_location      
       | table traffic_location

Now use traffic_location as fieldForDisplay/fieldForValue

0 Karma

Communicator
  <fieldset submitButton="true" autoRun="true">
    <input type="dropdown" token="field1">

      <search>
        <query>index=main source=traffic_information
      | search * traffic_location 
      | stats count by traffic_location 
      | eval field1=mvindex(split(traffic_location," "),0)
      | dedup field1
      | table field1</query>
      </search>
        <fieldsForLabel>field1</fieldsForLabel>
      <fieldsForValue>field1</fieldsForValue>
        </input>

      </fieldset>

  Still shows duplicate values causing conflicts, no data.

Revered Legend

try the updated answer

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!