Is it possible to have dropdown populated with values from a search that uses a token from a previous text box?

[ericrobinson]

Basic problem is that I need to pull out valid reporting dates for each account.

If you can imagine a text box, and a drop-down.. The text box is looking for an account number. I then want splunk to run the populating search for the dropdown to get the valid reporting dates, using the account number entered in the text box. Is this possible?

[Patient]

Hello,

If you are using splunk 6 or more, It's possible. You can add the token for the tex box to populating search for the dropdown. you can find the exemple below which have dropdown populated sourcetype with values from a search that uses a token from a previous text box for index:

<form>
  <label>Dashboard_Token</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="text" token="index" searchWhenChanged="true">
      <label>entrer index</label>
    </input>
    <input type="dropdown" token="Sourcetype" searchWhenChanged="true">
      <default>*</default>
      <populatingSearch earliest="0" latest="" fieldForLabel="sourcetype" fieldForValue="sourcetype">index=$index$ | stats count by sourcetype</populatingSearch>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <searchString>index=$index$ OR index=_$index$ | table index sourcetype</searchString>
        <earliestTime/>
        <latestTime/>
      </table>
    </panel>
  </row>
</form>

You can copy and create a dashboard in the search app with a simple xml above to see more.

regard,
Patient