I am trying to populate values to a dropdown using the search query. Following is the code:
<input type="dropdown" token="sub_tok" searchWhenChanged="true">
<label>Subdivisions List</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>subdivision</fieldForLabel>
<fieldForValue>subdivision</fieldForValue>
<search>
<query>`mymainlog` | rex field=_raw max_match=100 "<(<subdivision>\d{4})," | stats values(subdivision) as subDivs | mvexpand subDivs | rename subDivs as SubDivisionList </query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<delimiter> </delimiter>
</input>
But I am getting this error Could not create search
. But this query is running perfectly fine when executing it as a new search. I am getting almost 40 rows in the search results. But none is getting populated to the dropdown. I had even tried adding head 5
, in order to limit the number of rows, but of no luck.
I am using Splunk version 6.5.4
Please help me out.
Your search query returns a field SubDivisionList
but your input is set to use the field subdivision
. Your input is looking for a field that doesn't exist so it has no values to display.
@Naren26, can you try escaping the angular brackets <
and >
with <
and >
in you search query for the drop down?
Alternatively, you can save your working query as a dashboard panel and then copy paste to the input search query. Please try out and confirm.
This has done the trick. Thanks
@Naren26, I have converted to answer. Please accept to mark this as answered.