Dashboards & Visualizations

How to extract unique values from a column into a drop-down menu?

smhsplunk
Communicator

Trying to extract unique values from a column and display them in the drop-down menu:

index=main source=traffic_information
      | search * traffic_location 
      | fields traffic_location 
      | dedup traffic_location 
      | eval traffic_location=split(traffic_location, " ") 
      | eval field1=mvindex(traffic_location,0) 
      | stats values(field1)

So far I don't see anything, but this works perfectly fine when I use the same command in Splunk search, but in a dashboard, it doesn't work.

Please help.

Thanks

0 Karma

somesoni2
Revered Legend

Your search gives a multivalued field with name 'values(field1)' and you must be selecting 'field1' as fieldForDisplay/fieldForValue. Update the query like this

Updated

index=main source=traffic_information
       | search * traffic_location 
       | stats count by traffic_location      
       | eval traffic_location=mvindex(split(traffic_location, " "),0)
       | stats count by traffic_location      
       | table traffic_location

Now use traffic_location as fieldForDisplay/fieldForValue

0 Karma

smhsplunk
Communicator
  <fieldset submitButton="true" autoRun="true">
    <input type="dropdown" token="field1">

      <search>
        <query>index=main source=traffic_information
      | search * traffic_location 
      | stats count by traffic_location 
      | eval field1=mvindex(split(traffic_location," "),0)
      | dedup field1
      | table field1</query>
      </search>
        <fieldsForLabel>field1</fieldsForLabel>
      <fieldsForValue>field1</fieldsForValue>
        </input>

      </fieldset>

  Still shows duplicate values causing conflicts, no data.

somesoni2
Revered Legend

try the updated answer

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...