Good afternoon,
I am trying to show information from a csv which is static, but will be replaced as time goes on I awas wondering there was a way to make the CSV filenames a dropdown option in an input which would correlate in the searches below in the dashboard.
For example
Input dropdown values:
july.csv
august.csv
And the search would be
| inputlookup $august.csv$ ...
Is this an option or is there a better way to do this?
Sure you can do that - you can either populate the dropdown with static options with the month name and add the .csv on the end for the value, e.g.
<input type="dropdown" token="month">
<label>Month</label>
<choice value="july">July</choice>
<choice value="august">August</choice>
... more choices
</input>
then your search is
| inputlookup $month$.csv ...
or you could make your lookup dynamic and look for lookups that match a pattern, e.g.
<input type="dropdown" token="month">
<label>Month</label>
<search>
<query>
| rest splunk_server=local /servicesNS/-/-/data/lookup-table-files
| where 'eai:acl.app'="your_app_name"
| fields title
| where match(title, "^(january|february|march|april|may|june|july|august|september|october|november|december).csv$")
| eval month=replace(title, "\.csv", ""), month=upper(substr(month, 1,1)).substr(month, 2)
</query>
</search>
<fieldForLabel>month</fieldForLabel>
<fieldForValue>title</fieldForValue>
</input>