Dashboards & Visualizations

Populating Form Dropdowns via searches

mcwomble
Path Finder

I have a question regarding the population of dropdowns via saved searches.

The examples in the Splunk documentation show a search similar to the following:

   <populatingSearch fieldForValue="suser" fieldForLabel="suser"><!CDATA[sourcetype=p4change | rex "user=(?<suser>\w+)@" | stats count by suser]]></populatingSearch>

However, I am slightly confused (maybe because the search in the examples is quite complex) on how this is carried out in practice.

I wish to populate the dropdown with the contents of the partner field which has up to 200 different values within the indexed data. The string being as follows:

2010/12/13@13:31:22,billstats,partner=XXXX,cde=XX,usd=XX

How would I write the example population string in a way which can parse my indexed data in a way that could populate the dropdown?

Tags (1)
0 Karma
1 Solution

ziegfried
Influencer
<populatingSearch fieldForValue="partner" fieldForLabel="partner">
    sourcetype=your_sourcetype | fields partner | dedup partner
</populatingSearch>

View solution in original post

ziegfried
Influencer
<populatingSearch fieldForValue="partner" fieldForLabel="partner">
    sourcetype=your_sourcetype | fields partner | dedup partner
</populatingSearch>

mcwomble
Path Finder

Brilliant! That works a treat

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...