Unable to populate dropdown dynamically using PostProcess Search. Error: "Could not create search"

[ishangajera]

For my music2.csv file with content as below:

"artist_name","track_name"
Rihanna,"You Da One"
Rihanna,"We Found Love"

I want to load dropdown with the distinct artist_names using a basesearch and post-process search as below:

<form>
  <label>Error Macro Dashboard</label>
  <search id="baseSearch">
    <query>|inputlookup music2.csv | stats count by artist_name</query>
  </search>
<fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="tok_artist_name">
      <label>Select Artist</label>
      <search base="baseSearch">
        <query>search artist_name="R*"</query>
      </search>
      <fieldForLabel>artist_name</fieldForLabel>
      <fieldForValue>artist_name</fieldForValue>
    </input>
</fieldset>
</form>

But on screen the dropdown doesn't populate with any values and below dropdown an error msg is show as:
Could not create search.

[lavanyaanne]

If You want to Display Dynamically you have to mention something in Query you are just searching search artist_name="R*"

so as per my view search artist_name="R*"|stats count by artist_name know you will get the list of Artists names starts with R

[ishangajera]

Hi,

The data is not the issue, the issue is my dropdown is not accepting base search as I have done in my first post. It is expecting full search query.

[lavanyaanne]

plz refer splunk Doc http://docs.splunk.com/Documentation/Splunk/6.2.4/AdvancedDev/PostProcess
there may be some limitations in display the result of post process search

[ishangajera]

Thanks Lavanya.

That data limitation is only when post-process is search on non-transforming base search.

In my case, I have used stats command in base search which transforms the data and so there should be no data limitation in post-process search.
Also my csv contains only 2 records and only one distinct artist name so data must not be the issue.

[gcato]

Hi Ishangajera,

In regards to 10k data limitation for post-search, my understanding (from reading the documentation) is that transforming commands do not remove this limitation; it's simply a way to reduce the amount of _raw data to hopefully less than 10k. I've not actually tested this, so I could be wrong. Maybe I'll give it a go if I get some time.

[gcato · Accepted solution]

There is a detailed example with the correct format in the documentation here:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/Buildandeditforms#Create_a_form_with_a_global...

Using your example code and the documentation the the correct syntax would look something like this (not tested).

 <search id="baseSearch">
   <query>|inputlookup music2.csv | stats count by artist_name</query>
 </search>
 <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="tok_artist_name">
      <label>Select Artist</label>
      <default>R*</default>
      <choice value="search artist_name="R*"">R*</choice>
      ... etc ...

    </input> 

 </fieldset>

[gcato]

Okay, I see what you mean now. I couldn't get it to work either until I added a Submit button, then it populated okay. I'm sure there's a good reason why.

Here's the code I used (with Submit) that worked.

<form>
  <label>Artist Name</label>
  <search id="baseSearch">
    <query>|inputlookup music2.csv |stats values(artist_name) as artist_name, list(track_name) as track_name, count as count_artist_tracks</query>
  </search>
  <fieldset submitButton="true" autoRun="true">
    <input type="dropdown" token="tok_artist_name" searchWhenChanged="true">
      <label>Select Artist</label>
      <search base="baseSearch">
        <query>fields artist_name |sort artist name</query>
      </search>
      <fieldForLabel>artist_name</fieldForLabel>
      <fieldForValue>artist_name</fieldForValue>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search base="baseSearch">
          <query>search artist_name=$tok_artist_name|s$ |table *</query>
          <earliest></earliest>
          <latest></latest>
        </search>
      </table>
    </panel>
  </row>
</form>

You may be aware already, but watch out for the 10k limit on global and post-searches.

[ishangajera]

Hey Thanks! That solved my issue.

By adding submitButton="true" in fieldset, got the post process to work.

If you find the reason why that is required, please let me know.

[ishangajera]

Hi,

Actually I want the dropdown with distinct artist_names from the output of basesearch.
The above solution will populate dropdown with single item as "R*"