Dashboards & Visualizations

What is the maximum limitation of drop-down values ?

nibedan2020
New Member

I am trying to set up a dropdown on over 90000 unique values. But all the values are not coming in the dropdown. why this is happening? Are there any limitations?

0 Karma

woodcock
Esteemed Legend

Even if it was working, it would be functionally useless. When we have to do this kind of thing, we institute a pre-filter like this (here we are searching for server names) which cuts down the actual list to a manageable level.

<input type="text" token="server_name_partial" searchWhenChanged="false">
  <label>RegEx filter for Server Dropdown --></label>
  <default>.</default>
</input>
<input type="dropdown" token="server_name" searchWhenChanged="false">
  <label>(<-- filtered) Server Selector:</label>
  <default>*</default>
  <choice value="*">All</choice>
  <fieldForLabel>server_name</fieldForLabel>
  <fieldForValue>server_name</fieldForValue>
  <search>
    <query>| inputcsv servernamelist.csv | regex server_name="(?i)$server_name_partial$" | table server_name</query>
    <earliest>-1s</earliest>
    <latest>now</latest>
  </search>
</input>
0 Karma

anmolpatel
Builder

Unsure if there is a max limit to the dropdown.
There is one way to test this out.

1) Write the current list of unique values to a lookup table

index=test
| stats count by Unique_values
| outputlookup Unique_values.csv

2) now create the dropdown

| inputlookup Unique_values.csv
| fields Unique_values

This overcomes any issues that could be happening due to slow search output or any other performance hit. If it populates all values, job done, otherwise there might be a newly discovered feature (limit on dropdown values).

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...