Dashboards & Visualizations

Populating dropdown error : Could not create search

Naren26
Path Finder

I am trying to populate values to a dropdown using the search query. Following is the code:

<input type="dropdown" token="sub_tok" searchWhenChanged="true">
      <label>Subdivisions List</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>subdivision</fieldForLabel>
      <fieldForValue>subdivision</fieldForValue>
      <search>
        <query>`mymainlog` | rex field=_raw max_match=100 "<(<subdivision>\d{4})," | stats values(subdivision) as subDivs | mvexpand subDivs | rename subDivs as SubDivisionList </query>
        <earliest>-15m</earliest>
    <latest>now</latest>
      </search>
      <delimiter> </delimiter>
    </input>

But I am getting this error Could not create search. But this query is running perfectly fine when executing it as a new search. I am getting almost 40 rows in the search results. But none is getting populated to the dropdown. I had even tried adding head 5, in order to limit the number of rows, but of no luck.

I am using Splunk version 6.5.4

Please help me out.

micahkemp
Champion

Your search query returns a field SubDivisionList but your input is set to use the field subdivision. Your input is looking for a field that doesn't exist so it has no values to display.

niketnilay
Legend

@Naren26, can you try escaping the angular brackets < and > with &lt;and &gt; in you search query for the drop down?

Alternatively, you can save your working query as a dashboard panel and then copy paste to the input search query. Please try out and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Naren26
Path Finder

This has done the trick. Thanks

0 Karma

niketnilay
Legend

@Naren26, I have converted to answer. Please accept to mark this as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.