how to fill new values in 2nd dropdown by selecting a value in 1st dropdown after clearing previous values in 2nd dropdown

[sawgata12345]

Hi,
I have two dropdown D1 and D2.

on selecting a value in D1 certain values from event gets filled in D2. Now if i change the value in D1 new values are getting filled in D2 along with the previous values.
How do I clear the D2 before filling new values?

I tried tag also but still not working
[[

Initiator
initiator_id
initiator_id

index="demo1" | dedup initiator_id | table initiator_id



Target
target_id
target_id




index="demo1" initiator_id=$inits$ | dedup target_id | table target_id

]]

[Elsurion · Accepted solution]

Hi there

Your approach is not too bad, but you have to take the token for the seachh. I assume that you set that in your first dropdown, since it's not visible here

An example, how i have to this multiple times. One with four dropdowns but showing only the first two.

    <input type="dropdown" token="myindex" searchWhenChanged="true">
      <label>Application Log</label>
      <fieldForLabel>index</fieldForLabel>
      <fieldForValue>index</fieldForValue>
      <search>
        <query>| eventcount summarize=false index=log_* 
| dedup index 
| fields index</query>
        <earliest>$field1.earliest$</earliest>
        <latest>$field1.latest$</latest>
      </search>
      <change>
        <unset token="cust"></unset>
        <unset token="mysourcetype"></unset>
        <unset token="mysource"></unset>
        <unset token="myhost"></unset>
        <unset token="form.cust"></unset>
        <unset token="form.mysource"></unset>
        <unset token="form.mysourcetype"></unset>
        <unset token="form.myhost"></unset>
      </change>
    </input>
    <input type="dropdown" token="mysourcetype" searchWhenChanged="true">
      <label>Sourcetype</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=$myindex$
| fields sourcetype
| dedup sourcetype
| table sourcetype</query>
        <earliest>$field1.earliest$</earliest>
        <latest>$field1.latest$</latest>
      </search>
      <change>
        <unset token="cust"></unset>
        <unset token="mysource"></unset>
        <unset token="myhost"></unset>
        <unset token="form.cust"></unset>
        <unset token="form.mysource"></unset>
        <unset token="form.myhost"></unset>
      </change>
    </input>

[sawgata12345]

  <label>Initiator</label>
  <fieldForLabel>initiator_id</fieldForLabel>
  <fieldForValue>initiator_id</fieldForValue>
  <search>
    <query>index="demo1" | dedup initiator_id | table initiator_id</query>
  </search>
</input>
<input type="dropdown" token="targetsel" searchWhenChanged="true">
  <label>Target</label>
  <fieldForLabel>target_id</fieldForLabel>
  <fieldForValue>target_id</fieldForValue>
  <change>
     <unset token="form.dropdown"></unset>
  </change>
  <search>
    <query>index="demo1" initiator_id=$inits$ | dedup target_id | table target_id</query>
  </search>
</input>