Dashboards & Visualizations

Populating Dropdown with List of Indexes Not Working

klinjeff
New Member

I can't get a dropdown box to populate. I'm trying to allow the user to select an index from a dropdown list on my dashboard.

I can run the search query in the query block and get results, but it won't populate a drop down box. I've tried sticking the results into a table and that doesn't work either. There is a base query for the entire dashboard which is modified with the values of the input fields when they change. What am I missing? Is it possible to do a drop down box with just a list of all available indexes to the user?

<input type="dropdown" token="index_name_tok" searchWhenChanged="true">
      <label>Index</label>
      <choice value="*">All</choice>
      <initialValue>*</initialValue>
      <fieldForLabel>index_name</fieldForLabel>
      <fieldForValue>index_name</fieldForValue>
      <change>
        <set token="filter_query">NOT is_broadcast="true" index="$index_name_tok$" system_name="$system_name$" id_orig_h="$id_orig_h$" id_orig_p="$id_orig_p$" id_resp_h="$id_resp_h$" id_resp_p="$id_resp_p$" service="$service$"</set>
      </change>
      <search>
        <query>| eventcount summarize=false index=*bro* | fields index | dedup index | table index</query>
      </search>
</input>
0 Karma
1 Solution

somesoni2
Revered Legend

The search query is giving the field with name index but in fieldForLabel and fieldForValue attribute, you specified index_name which is not available hence the dropdown fails. Just change index_name with index in those.

View solution in original post

0 Karma

somesoni2
Revered Legend

The search query is giving the field with name index but in fieldForLabel and fieldForValue attribute, you specified index_name which is not available hence the dropdown fails. Just change index_name with index in those.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...