Dashboards & Visualizations

Why my dropdown input create an empty value?

mah
Builder

Hi,

I have a weird reaction of my dropdown input : 

mah_0-1609424359245.png

It seems the input create a empty value in the dropdown choice whereas when I run the input request, the result is giving just ID list : 

mah_1-1609424536912.png

Here is my xml code : 

<row>
<panel>
<title>ID list</title>
<input type="dropdown" token="id_tok" searchWhenChanged="true">
<label>Select an ID to delete</label>
<fieldForLabel>id</fieldForLabel>
<fieldForValue>id</fieldForValue>
<search>
<query>| inputlookup id_list.csv
| fields id
| dedup id</query>
<earliest>-1m@m</earliest>
<latest>now</latest>
</search>
<prefix>"</prefix>
<suffix>"</suffix>
</input>
<table>
<search>
<query>| makeresults
| eval ID=$id_tok$
| fields - _time
| dedup ID
| outputlookup append=t id_delete.csv</query>
<earliest>-1m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<refresh>1m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>

Beside, my panel request does not seem to work : " Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.

The fact is that when I open the search, the token value is not set...  : 

 

mah_0-1609425127352.png

 

Can you help me ? 

Thanks !

Labels (1)
0 Karma

to4kawa
Ultra Champion
<row>
<panel>
<title>ID list</title>
<input type="dropdown" token="id_tok" searchWhenChanged="true">
<label>Select an ID to delete</label>
<fieldForLabel>name</fieldForLabel>
<fieldForValue>id</fieldForValue>
<search>
<query>| inputlookup id_list.csv
| fields id
| dedup id
|eval name=substr(id,1,4)</query>
<earliest>-1m@m</earliest>
<latest>now</latest>
</search>
<prefix>"</prefix>
<suffix>"</suffix>
</input>
<table>
<search>
<query>| makeresults 
| eval ID=$id_tok$
| fields - _time
| dedup ID
| outputlookup append=t id_delete.csv</query>
<earliest>-1m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<refresh>1m</refresh>
<refreshType>delay</refreshType>
</search>
</table>
</panel>
</row>

Dropdown should have a separate name and value.

0 Karma

mah
Builder

Hi @to4kawa 

I apply your code but it gives me this : 

mah_0-1609429777679.png

In the above panel I table all ids, and with this settings :

<fieldForLabel>name</fieldForLabel>
<fieldForValue>id</fieldForValue>

 

mah_0-1609430034738.png

I get "name" values and not "id" values ...

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...