Dashboards & Visualizations

Populating dropdown error : Could not create search

Naren26
Path Finder

I am trying to populate values to a dropdown using the search query. Following is the code:

<input type="dropdown" token="sub_tok" searchWhenChanged="true">
      <label>Subdivisions List</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>subdivision</fieldForLabel>
      <fieldForValue>subdivision</fieldForValue>
      <search>
        <query>`mymainlog` | rex field=_raw max_match=100 "<(<subdivision>\d{4})," | stats values(subdivision) as subDivs | mvexpand subDivs | rename subDivs as SubDivisionList </query>
        <earliest>-15m</earliest>
    <latest>now</latest>
      </search>
      <delimiter> </delimiter>
    </input>

But I am getting this error Could not create search. But this query is running perfectly fine when executing it as a new search. I am getting almost 40 rows in the search results. But none is getting populated to the dropdown. I had even tried adding head 5, in order to limit the number of rows, but of no luck.

I am using Splunk version 6.5.4

Please help me out.

micahkemp
Champion

Your search query returns a field SubDivisionList but your input is set to use the field subdivision. Your input is looking for a field that doesn't exist so it has no values to display.

niketn
Legend

@Naren26, can you try escaping the angular brackets < and > with &lt;and &gt; in you search query for the drop down?

Alternatively, you can save your working query as a dashboard panel and then copy paste to the input search query. Please try out and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Naren26
Path Finder

This has done the trick. Thanks

0 Karma

niketn
Legend

@Naren26, I have converted to answer. Please accept to mark this as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...