Dashboards & Visualizations

Why am I getting the dynamic drop-down error "Search is waiting for input"?

Communicator

I have a dynamic dropdown which takes a token $parent$ as an input for its populating search. I get the $parent$ tag by grabbing the current user's role and using it to get the final parent value from a lookup table. When I run this search outside of the dashboard, I get one value. However, when the dashboard runs, the dynamic dropdown says: "Could not create search. Search is waiting for input."

What are some reasons for this? (Splunk version 6.6.3)

<form >
  <label>Dashboard</label>
 <search>
        <query>| rest /services/authentication/current-context/context 
    | where username !="splunk-system-user" 
    | fields roles 
    | mvexpand roles 
    | join type=inner roles 
        [| inputlookup role_parent.csv ]</query>
        <done>
          <set token="parent">$result.Parent$</set>
        </done>
      </search>
      <fieldset submitButton="true" autoRun="false">
        <input type="multiselect" token="customer">
          <label>Customer</label>
          <delimiter> </delimiter>
          <fieldForLabel>Customer</fieldForLabel>
          <fieldForValue>Customer</fieldForValue>
          <search>
            <query>| inputlookup customers.csv where Parent=$parent$ </query>
          </search>
        </input>
0 Karma
1 Solution

Champion

I think that you can do it drop down so that the search will be executed.

| inputlookup customers.csv where [※sub search]

※ sub search

| rest /services/authentication/current-context/context 
     | where username !="splunk-system-user" 
     | fields roles 
     | mvexpand roles 
     | join type=inner roles 
         [| inputlookup role_parent.csv ]
     | table Parent

View solution in original post

Influencer

There should be a | before “where” in your inputlookup query for your multi select customer input

0 Karma

Champion

I think that you can do it drop down so that the search will be executed.

| inputlookup customers.csv where [※sub search]

※ sub search

| rest /services/authentication/current-context/context 
     | where username !="splunk-system-user" 
     | fields roles 
     | mvexpand roles 
     | join type=inner roles 
         [| inputlookup role_parent.csv ]
     | table Parent

View solution in original post

Communicator

This worked for me. Thanks!

0 Karma