Splunk Enterprise

Dynamically load a dropdown from a value chosen from another

fabrizioalleva
Path Finder

Hi all,

I'm trying to populate a dropdown with dynamic values according the value coming from another dropdown, like unit measure for example:

if the dropdown A contains Fruits the B will contain (1000 gr, 100 hg, 1 kG ) instead if the A cointains Liquid B will cointains (1000 ml. 100 cl. )

where 1000/100/1 will be Field For Value

and gr hg and KG will be field for Label.

 

I'm trying something like this :

| makeresults
| eval type="fruits"
| eval unit=case(type=="fruits","1000 gr, 100 hg, 1 kg", type=="liquid","1000 ml, 100 cl", 1=1, "no vlaue")
| rex field=unit "(?<A>.*)\,(?<B>.*)"
| fields A B

But I'm not be able to parameterize the two or three values in the fields to make the split..

Thanks

 

Labels (1)
0 Karma
1 Solution

renjith_nair
Legend

Does this work for you?

| makeresults
| eval type="fruits"
| eval unit=case(type=="fruits","1000#gr, 100#hg, 1#kg", type=="liquid","1000#ml, 100#cl", 1=1, "no vlaue")|makemv unit delim=","|mvexpand unit
| rex field=unit "(?<A>.*)#(?<B>.*)"
| fields A B
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

Does this work for you?

| makeresults
| eval type="fruits"
| eval unit=case(type=="fruits","1000#gr, 100#hg, 1#kg", type=="liquid","1000#ml, 100#cl", 1=1, "no vlaue")|makemv unit delim=","|mvexpand unit
| rex field=unit "(?<A>.*)#(?<B>.*)"
| fields A B
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

fabrizioalleva
Path Finder

Thanks a lot

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...