Dashboards & Visualizations

Why my dropdown input create an empty value?

mah
Builder

Hi,

I have a weird reaction of my dropdown input : 

mah_0-1609424359245.png

It seems the input create a empty value in the dropdown choice whereas when I run the input request, the result is giving just ID list : 

mah_1-1609424536912.png

Here is my xml code : 

<row>
<panel>
<title>ID list</title>
<input type="dropdown" token="id_tok" searchWhenChanged="true">
<label>Select an ID to delete</label>
<fieldForLabel>id</fieldForLabel>
<fieldForValue>id</fieldForValue>
<search>
<query>| inputlookup id_list.csv
| fields id
| dedup id</query>
<earliest>-1m@m</earliest>
<latest>now</latest>
</search>
<prefix>"</prefix>
<suffix>"</suffix>
</input>
<table>
<search>
<query>| makeresults
| eval ID=$id_tok$
| fields - _time
| dedup ID
| outputlookup append=t id_delete.csv</query>
<earliest>-1m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<refresh>1m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>

Beside, my panel request does not seem to work : " Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.

The fact is that when I open the search, the token value is not set...  : 

 

mah_0-1609425127352.png

 

Can you help me ? 

Thanks !

Labels (1)
0 Karma

to4kawa
Ultra Champion
<row>
<panel>
<title>ID list</title>
<input type="dropdown" token="id_tok" searchWhenChanged="true">
<label>Select an ID to delete</label>
<fieldForLabel>name</fieldForLabel>
<fieldForValue>id</fieldForValue>
<search>
<query>| inputlookup id_list.csv
| fields id
| dedup id
|eval name=substr(id,1,4)</query>
<earliest>-1m@m</earliest>
<latest>now</latest>
</search>
<prefix>"</prefix>
<suffix>"</suffix>
</input>
<table>
<search>
<query>| makeresults 
| eval ID=$id_tok$
| fields - _time
| dedup ID
| outputlookup append=t id_delete.csv</query>
<earliest>-1m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<refresh>1m</refresh>
<refreshType>delay</refreshType>
</search>
</table>
</panel>
</row>

Dropdown should have a separate name and value.

0 Karma

mah
Builder

Hi @to4kawa 

I apply your code but it gives me this : 

mah_0-1609429777679.png

In the above panel I table all ids, and with this settings :

<fieldForLabel>name</fieldForLabel>
<fieldForValue>id</fieldForValue>

 

mah_0-1609430034738.png

I get "name" values and not "id" values ...

 

Tags (1)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How to find the worst searches in your Splunk environment and how to fix them

Everyone knows Splunk is a powerful platform for running searches and doing data analytics. Your ...

Share Your Feedback: On Admin Config Service (ACS)!

Help Us Build a Better Admin Config Service Experience (ACS)   We Want Your Feedback on Admin Config Service ...

Build the Future of Agentic AI: Join the Splunk Agentic Ops Hackathon

AI is changing how teams investigate incidents, detect threats, automate workflows, and build intelligent ...