Dashboards & Visualizations

Use dropdown filled by query on dynamic field in fieldset section of XML

richtate
Path Finder

I have a dropdown that has dynamic data, changes by the day, that I want filled in the dropdown for selection and use in the dashboard.  I've followed several entries from the community but the dropdown is blank, only showing the ALL from the 'choice' entry.  Here is the SPL,

 

<fieldset submitButton="true">
 <input type="dropdown" token="tok_site" searchWhenChanged="false">
  <label>Site</label>
  <search>
   <query>earliest=-2h index=asset sourcetype=Armis:Asset
                    | stats count by site.name

   </query>
  </search>
  <choice value="*">ALL</choice>
  <default>*</default>
  <fieldForLabel>Site</fieldForLabel>
  <fieldForValue>Site</fieldForValue>
 </input>

</fieldset>

I will be adding a couple more dropdowns later, but they are dynamic as well.  If I can't get one to work, well..

Any suggestion on where I've made a mistake?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The SPL <fieldForLabel> and <fieldForValue> elements say the Site field should be used to populate the dropdown, but that field does not exist.  The only fields produced by the query are count and site.name.  If you change the SPL to make sure the field names in the dropdown exist then it should work.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The SPL <fieldForLabel> and <fieldForValue> elements say the Site field should be used to populate the dropdown, but that field does not exist.  The only fields produced by the query are count and site.name.  If you change the SPL to make sure the field names in the dropdown exist then it should work.

---
If this reply helps you, Karma would be appreciated.

richtate
Path Finder

Yep, that was it, I changed the field value to site.name and it is working.  Thanks for pointing that out!

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...