Dashboards & Visualizations

Why am I getting the dynamic drop-down error "Search is waiting for input"?

matstap
Communicator

I have a dynamic dropdown which takes a token $parent$ as an input for its populating search. I get the $parent$ tag by grabbing the current user's role and using it to get the final parent value from a lookup table. When I run this search outside of the dashboard, I get one value. However, when the dashboard runs, the dynamic dropdown says: "Could not create search. Search is waiting for input."

What are some reasons for this? (Splunk version 6.6.3)

<form >
  <label>Dashboard</label>
 <search>
        <query>| rest /services/authentication/current-context/context 
    | where username !="splunk-system-user" 
    | fields roles 
    | mvexpand roles 
    | join type=inner roles 
        [| inputlookup role_parent.csv ]</query>
        <done>
          <set token="parent">$result.Parent$</set>
        </done>
      </search>
      <fieldset submitButton="true" autoRun="false">
        <input type="multiselect" token="customer">
          <label>Customer</label>
          <delimiter> </delimiter>
          <fieldForLabel>Customer</fieldForLabel>
          <fieldForValue>Customer</fieldForValue>
          <search>
            <query>| inputlookup customers.csv where Parent=$parent$ </query>
          </search>
        </input>
0 Karma
1 Solution

HiroshiSatoh
Champion

I think that you can do it drop down so that the search will be executed.

| inputlookup customers.csv where [※sub search]

※ sub search

| rest /services/authentication/current-context/context 
     | where username !="splunk-system-user" 
     | fields roles 
     | mvexpand roles 
     | join type=inner roles 
         [| inputlookup role_parent.csv ]
     | table Parent

View solution in original post

Vijeta
Influencer

There should be a | before “where” in your inputlookup query for your multi select customer input

0 Karma

HiroshiSatoh
Champion

I think that you can do it drop down so that the search will be executed.

| inputlookup customers.csv where [※sub search]

※ sub search

| rest /services/authentication/current-context/context 
     | where username !="splunk-system-user" 
     | fields roles 
     | mvexpand roles 
     | join type=inner roles 
         [| inputlookup role_parent.csv ]
     | table Parent

matstap
Communicator

This worked for me. Thanks!

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...