Dashboards & Visualizations

Populating Dropdown with List of Indexes Not Working

klinjeff
New Member

I can't get a dropdown box to populate. I'm trying to allow the user to select an index from a dropdown list on my dashboard.

I can run the search query in the query block and get results, but it won't populate a drop down box. I've tried sticking the results into a table and that doesn't work either. There is a base query for the entire dashboard which is modified with the values of the input fields when they change. What am I missing? Is it possible to do a drop down box with just a list of all available indexes to the user?

<input type="dropdown" token="index_name_tok" searchWhenChanged="true">
      <label>Index</label>
      <choice value="*">All</choice>
      <initialValue>*</initialValue>
      <fieldForLabel>index_name</fieldForLabel>
      <fieldForValue>index_name</fieldForValue>
      <change>
        <set token="filter_query">NOT is_broadcast="true" index="$index_name_tok$" system_name="$system_name$" id_orig_h="$id_orig_h$" id_orig_p="$id_orig_p$" id_resp_h="$id_resp_h$" id_resp_p="$id_resp_p$" service="$service$"</set>
      </change>
      <search>
        <query>| eventcount summarize=false index=*bro* | fields index | dedup index | table index</query>
      </search>
</input>
0 Karma
1 Solution

somesoni2
Revered Legend

The search query is giving the field with name index but in fieldForLabel and fieldForValue attribute, you specified index_name which is not available hence the dropdown fails. Just change index_name with index in those.

View solution in original post

0 Karma

somesoni2
Revered Legend

The search query is giving the field with name index but in fieldForLabel and fieldForValue attribute, you specified index_name which is not available hence the dropdown fails. Just change index_name with index in those.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...