Splunk Enterprise

Dynamically load a dropdown from a value chosen from another

fabrizioalleva
Path Finder

Hi all,

I'm trying to populate a dropdown with dynamic values according the value coming from another dropdown, like unit measure for example:

if the dropdown A contains Fruits the B will contain (1000 gr, 100 hg, 1 kG ) instead if the A cointains Liquid B will cointains (1000 ml. 100 cl. )

where 1000/100/1 will be Field For Value

and gr hg and KG will be field for Label.

 

I'm trying something like this :

| makeresults
| eval type="fruits"
| eval unit=case(type=="fruits","1000 gr, 100 hg, 1 kg", type=="liquid","1000 ml, 100 cl", 1=1, "no vlaue")
| rex field=unit "(?<A>.*)\,(?<B>.*)"
| fields A B

But I'm not be able to parameterize the two or three values in the fields to make the split..

Thanks

 

Labels (1)
0 Karma
1 Solution

renjith_nair
Legend

Does this work for you?

| makeresults
| eval type="fruits"
| eval unit=case(type=="fruits","1000#gr, 100#hg, 1#kg", type=="liquid","1000#ml, 100#cl", 1=1, "no vlaue")|makemv unit delim=","|mvexpand unit
| rex field=unit "(?<A>.*)#(?<B>.*)"
| fields A B
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

Does this work for you?

| makeresults
| eval type="fruits"
| eval unit=case(type=="fruits","1000#gr, 100#hg, 1#kg", type=="liquid","1000#ml, 100#cl", 1=1, "no vlaue")|makemv unit delim=","|mvexpand unit
| rex field=unit "(?<A>.*)#(?<B>.*)"
| fields A B
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

fabrizioalleva
Path Finder

Thanks a lot

0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...