Dashboards & Visualizations

Populating dropdown error : Could not create search

Naren26
Path Finder

I am trying to populate values to a dropdown using the search query. Following is the code:

<input type="dropdown" token="sub_tok" searchWhenChanged="true">
      <label>Subdivisions List</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>subdivision</fieldForLabel>
      <fieldForValue>subdivision</fieldForValue>
      <search>
        <query>`mymainlog` | rex field=_raw max_match=100 "<(<subdivision>\d{4})," | stats values(subdivision) as subDivs | mvexpand subDivs | rename subDivs as SubDivisionList </query>
        <earliest>-15m</earliest>
    <latest>now</latest>
      </search>
      <delimiter> </delimiter>
    </input>

But I am getting this error Could not create search. But this query is running perfectly fine when executing it as a new search. I am getting almost 40 rows in the search results. But none is getting populated to the dropdown. I had even tried adding head 5, in order to limit the number of rows, but of no luck.

I am using Splunk version 6.5.4

Please help me out.

micahkemp
Champion

Your search query returns a field SubDivisionList but your input is set to use the field subdivision. Your input is looking for a field that doesn't exist so it has no values to display.

niketn
Legend

@Naren26, can you try escaping the angular brackets < and > with &lt;and &gt; in you search query for the drop down?

Alternatively, you can save your working query as a dashboard panel and then copy paste to the input search query. Please try out and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Naren26
Path Finder

This has done the trick. Thanks

0 Karma

niketn
Legend

@Naren26, I have converted to answer. Please accept to mark this as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Mastering Threat Intelligence in ES 8.5, Splunk AI Assistant v2, and More from Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Break the Build: Inside the KubeDoom Lounge at .conf26

    You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...