Dashboards & Visualizations

Why am I getting the dynamic drop-down error "Search is waiting for input"?

matstap
Communicator

I have a dynamic dropdown which takes a token $parent$ as an input for its populating search. I get the $parent$ tag by grabbing the current user's role and using it to get the final parent value from a lookup table. When I run this search outside of the dashboard, I get one value. However, when the dashboard runs, the dynamic dropdown says: "Could not create search. Search is waiting for input."

What are some reasons for this? (Splunk version 6.6.3)

<form >
  <label>Dashboard</label>
 <search>
        <query>| rest /services/authentication/current-context/context 
    | where username !="splunk-system-user" 
    | fields roles 
    | mvexpand roles 
    | join type=inner roles 
        [| inputlookup role_parent.csv ]</query>
        <done>
          <set token="parent">$result.Parent$</set>
        </done>
      </search>
      <fieldset submitButton="true" autoRun="false">
        <input type="multiselect" token="customer">
          <label>Customer</label>
          <delimiter> </delimiter>
          <fieldForLabel>Customer</fieldForLabel>
          <fieldForValue>Customer</fieldForValue>
          <search>
            <query>| inputlookup customers.csv where Parent=$parent$ </query>
          </search>
        </input>
0 Karma
1 Solution

HiroshiSatoh
Champion

I think that you can do it drop down so that the search will be executed.

| inputlookup customers.csv where [※sub search]

※ sub search

| rest /services/authentication/current-context/context 
     | where username !="splunk-system-user" 
     | fields roles 
     | mvexpand roles 
     | join type=inner roles 
         [| inputlookup role_parent.csv ]
     | table Parent

View solution in original post

Vijeta
Influencer

There should be a | before “where” in your inputlookup query for your multi select customer input

0 Karma

HiroshiSatoh
Champion

I think that you can do it drop down so that the search will be executed.

| inputlookup customers.csv where [※sub search]

※ sub search

| rest /services/authentication/current-context/context 
     | where username !="splunk-system-user" 
     | fields roles 
     | mvexpand roles 
     | join type=inner roles 
         [| inputlookup role_parent.csv ]
     | table Parent

matstap
Communicator

This worked for me. Thanks!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...