Dropdown and input options on output which is obtained using join command

[supriyagaw08]

Hi All,

I am trying to add dropdown on workname but output always comes as no records found although that workname is present in the dashboard output.

Below is my code:

$Env$ sourcetype = s $field2$$input$
| table XMIT_NM,USER_NM,WORK_ID,FILE_NM,FILE_ID
| join
[ search $Env$ sourcetype=b
| table WORK_ID WORK_NM ]
| table XMIT_NM,USER_NM,WORK_NM,FILE_NM,FILE_ID

Below is my XML:
<input type="dropdown" token="field2" searchWhenChanged="true">
<label>Search</label>
<choice value="&quot;*&quot;">Any</choice>

<choice value="USER_NM">username</choice>
<choice value="WORK_NM">Work name</choice>
<default>"*"</default>
<initialValue>"*"</initialValue>


I have tried <choice value="WORK_NM=">Work name</choice> and <choice value="&quot;WORK_NM&quot;">Work name</choice> as well but its not working but search using USER_NM is working fine, please suggest is it due to WORK_NM is output from join command and hence it cannot be used or any other ways to make this work.

[scelikok]

Hi @supriyagaw08,

If WORK_NM is only exist on sub-search that is why your "field2" token filters everything on the first search.

It will make Splunk search/join more events but below may work;

$Env$ sourcetype = s 
| table XMIT_NM,USER_NM,WORK_ID,FILE_NM,FILE_ID
| join
[ search $Env$ sourcetype=b
| table WORK_ID WORK_NM ]
| search $field2$$input$
| table XMIT_NM,USER_NM,WORK_NM,FILE_NM,FILE_ID

If this reply helps you an upvote is appreciated. 

[supriyagaw08]

Any help on this will be appreciated, thanks.