Dashboards & Visualizations

Unable to populate dropdown dynamically using PostProcess Search. Error: "Could not create search"

ishangajera
Explorer

For my music2.csv file with content as below:

"artist_name","track_name"
Rihanna,"You Da One"
Rihanna,"We Found Love"

I want to load dropdown with the distinct artist_names using a basesearch and post-process search as below:

<form>
  <label>Error Macro Dashboard</label>
  <search id="baseSearch">
    <query>|inputlookup music2.csv | stats count by artist_name</query>
  </search>
<fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="tok_artist_name">
      <label>Select Artist</label>
      <search base="baseSearch">
        <query>search artist_name="R*"</query>
      </search>
      <fieldForLabel>artist_name</fieldForLabel>
      <fieldForValue>artist_name</fieldForValue>
    </input>
</fieldset>
</form>

But on screen the dropdown doesn't populate with any values and below dropdown an error msg is show as:
Could not create search.

1 Solution

gcato
Contributor

There is a detailed example with the correct format in the documentation here:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/Buildandeditforms#Create_a_form_with_a_global...

Using your example code and the documentation the the correct syntax would look something like this (not tested).

 <search id="baseSearch">
   <query>|inputlookup music2.csv | stats count by artist_name</query>
 </search>
 <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="tok_artist_name">
      <label>Select Artist</label>
      <default>R*</default>
      <choice value="search artist_name="R*"">R*</choice>
      ... etc ...

    </input> 

 </fieldset>

View solution in original post

lavanyaanne
Path Finder

If You want to Display Dynamically you have to mention something in Query you are just searching search artist_name="R*"

so as per my view search artist_name="R*"|stats count by artist_name know you will get the list of Artists names starts with R

0 Karma

ishangajera
Explorer

Hi,

The data is not the issue, the issue is my dropdown is not accepting base search as I have done in my first post. It is expecting full search query.

0 Karma

lavanyaanne
Path Finder

plz refer splunk Doc http://docs.splunk.com/Documentation/Splunk/6.2.4/AdvancedDev/PostProcess
there may be some limitations in display the result of post process search

0 Karma

ishangajera
Explorer

Thanks Lavanya.

That data limitation is only when post-process is search on non-transforming base search.

In my case, I have used stats command in base search which transforms the data and so there should be no data limitation in post-process search.
Also my csv contains only 2 records and only one distinct artist name so data must not be the issue.

0 Karma

gcato
Contributor

Hi Ishangajera,

In regards to 10k data limitation for post-search, my understanding (from reading the documentation) is that transforming commands do not remove this limitation; it's simply a way to reduce the amount of _raw data to hopefully less than 10k. I've not actually tested this, so I could be wrong. Maybe I'll give it a go if I get some time.

0 Karma

gcato
Contributor

There is a detailed example with the correct format in the documentation here:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/Buildandeditforms#Create_a_form_with_a_global...

Using your example code and the documentation the the correct syntax would look something like this (not tested).

 <search id="baseSearch">
   <query>|inputlookup music2.csv | stats count by artist_name</query>
 </search>
 <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="tok_artist_name">
      <label>Select Artist</label>
      <default>R*</default>
      <choice value="search artist_name="R*"">R*</choice>
      ... etc ...

    </input> 

 </fieldset>

gcato
Contributor

Okay, I see what you mean now. I couldn't get it to work either until I added a Submit button, then it populated okay. I'm sure there's a good reason why.

Here's the code I used (with Submit) that worked.

<form>
  <label>Artist Name</label>
  <search id="baseSearch">
    <query>|inputlookup music2.csv |stats values(artist_name) as artist_name, list(track_name) as track_name, count as count_artist_tracks</query>
  </search>
  <fieldset submitButton="true" autoRun="true">
    <input type="dropdown" token="tok_artist_name" searchWhenChanged="true">
      <label>Select Artist</label>
      <search base="baseSearch">
        <query>fields artist_name |sort artist name</query>
      </search>
      <fieldForLabel>artist_name</fieldForLabel>
      <fieldForValue>artist_name</fieldForValue>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search base="baseSearch">
          <query>search artist_name=$tok_artist_name|s$ |table *</query>
          <earliest></earliest>
          <latest></latest>
        </search>
      </table>
    </panel>
  </row>
</form>

You may be aware already, but watch out for the 10k limit on global and post-searches.

ishangajera
Explorer

Hey Thanks! That solved my issue.

By adding submitButton="true" in fieldset, got the post process to work.

If you find the reason why that is required, please let me know.

0 Karma

ishangajera
Explorer

Hi,

Actually I want the dropdown with distinct artist_names from the output of basesearch.
The above solution will populate dropdown with single item as "R*"

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...