Dropdown to restrict the device display?

[alex8103]

Hello everyone,
Due to the high number of identical devices, I would like to be able to select which devices should be displayed via a dropdown. Has anyone done this before and can possibly give me the procedure and the code?

Many thanks and best regards

Alex

[deepakc]

Sound like a case for dedup, based on that you can optionally also place the devices into a lookup file and also use that. (You can then use that SPL in your drop down menu which is what I suspect you want to do)

See the examples and if that meets what you want to do.

https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/Dedup#Examples