Dashboards & Visualizations

Why my dropdown input create an empty value?

mah
Builder

Hi,

I have a weird reaction of my dropdown input : 

mah_0-1609424359245.png

It seems the input create a empty value in the dropdown choice whereas when I run the input request, the result is giving just ID list : 

mah_1-1609424536912.png

Here is my xml code : 

<row>
<panel>
<title>ID list</title>
<input type="dropdown" token="id_tok" searchWhenChanged="true">
<label>Select an ID to delete</label>
<fieldForLabel>id</fieldForLabel>
<fieldForValue>id</fieldForValue>
<search>
<query>| inputlookup id_list.csv
| fields id
| dedup id</query>
<earliest>-1m@m</earliest>
<latest>now</latest>
</search>
<prefix>"</prefix>
<suffix>"</suffix>
</input>
<table>
<search>
<query>| makeresults
| eval ID=$id_tok$
| fields - _time
| dedup ID
| outputlookup append=t id_delete.csv</query>
<earliest>-1m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<refresh>1m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>

Beside, my panel request does not seem to work : " Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.

The fact is that when I open the search, the token value is not set...  : 

 

mah_0-1609425127352.png

 

Can you help me ? 

Thanks !

Labels (1)
0 Karma

to4kawa
Ultra Champion
<row>
<panel>
<title>ID list</title>
<input type="dropdown" token="id_tok" searchWhenChanged="true">
<label>Select an ID to delete</label>
<fieldForLabel>name</fieldForLabel>
<fieldForValue>id</fieldForValue>
<search>
<query>| inputlookup id_list.csv
| fields id
| dedup id
|eval name=substr(id,1,4)</query>
<earliest>-1m@m</earliest>
<latest>now</latest>
</search>
<prefix>"</prefix>
<suffix>"</suffix>
</input>
<table>
<search>
<query>| makeresults 
| eval ID=$id_tok$
| fields - _time
| dedup ID
| outputlookup append=t id_delete.csv</query>
<earliest>-1m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<refresh>1m</refresh>
<refreshType>delay</refreshType>
</search>
</table>
</panel>
</row>

Dropdown should have a separate name and value.

0 Karma

mah
Builder

Hi @to4kawa 

I apply your code but it gives me this : 

mah_0-1609429777679.png

In the above panel I table all ids, and with this settings :

<fieldForLabel>name</fieldForLabel>
<fieldForValue>id</fieldForValue>

 

mah_0-1609430034738.png

I get "name" values and not "id" values ...

 

Tags (1)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Break the Build: Inside the KubeDoom Lounge at .conf26

    You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...