Splunk Enterprise

data is not populating using dropdown selection

Khushboo
Explorer

Hi Everyone,

I have extracted field  name status using rex. Then I have added dropdown input in which I have all the values of status. 
But data is not getting refreshed after selecting any value from dropdown.
Though i have tried highlighted (status = $status$ ) in base query, where another dropdown with name level is working fine.

PFB snippet of my code:
<form>
<search id="base_search">
<query>
index=abc sourcetype=xyz earliest = $earliest$ latest = now()
id = $id$ level = $level$ status = $status$
| sort id asc
| rex field=msg "\{\"status\"\:\s+\"(?&lt;status&gt;[^\"\}]+)"
</query>
</search>
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="id" searchWhenChanged="true">
<label>Request Id</label>
<choice value="*">ALL</choice>
<fieldForLabel>id</fieldForLabel>
<fieldForValue>id</fieldForValue>
<search base="base_search_filter">
<query>search | dedup id
| table id</query>
</search>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="dropdown" token="status" searchWhenChanged="true">
<label>Status</label>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>status</fieldForLabel>
<fieldForValue>status</fieldForValue>
<search base="base_search_filter">
<query> search | dedup status
| table status</query>
</search>
</input>
</fieldset>
<row>
<panel>
<table>
<search base="base_search">
<query> search
| table id,  status,
</query>
</search>
<option name="drilldown">row</option>
</table>
</panel>
</row>
</form>

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Please try as below;

<form>
<search id="base_search">
<query>
index=abc sourcetype=xyz earliest = $earliest$ latest = now()
id = $id$ level = $level$ 
| rex field=msg "\{\"status\"\:\s+\"(?&lt;status&gt;[^\"\}]+)"
| search status = $status$
| sort id asc
</query>
</search>
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="id" searchWhenChanged="true">
<label>Request Id</label>
<choice value="*">ALL</choice>
<fieldForLabel>id</fieldForLabel>
<fieldForValue>id</fieldForValue>
<search base="base_search_filter">
<query>search | dedup id
| table id</query>
</search>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="dropdown" token="status" searchWhenChanged="true">
<label>Status</label>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>status</fieldForLabel>
<fieldForValue>status</fieldForValue>
<search base="base_search_filter">
<query> search | dedup status
| table status</query>
</search>
</input>
</fieldset>
<row>
<panel>
<table>
<search base="base_search">
<query> search
| table id,  status,
</query>
</search>
<option name="drilldown">row</option>
</table>
</panel>
</row>
</form>
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Please try as below;

<form>
<search id="base_search">
<query>
index=abc sourcetype=xyz earliest = $earliest$ latest = now()
id = $id$ level = $level$ 
| rex field=msg "\{\"status\"\:\s+\"(?&lt;status&gt;[^\"\}]+)"
| search status = $status$
| sort id asc
</query>
</search>
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="id" searchWhenChanged="true">
<label>Request Id</label>
<choice value="*">ALL</choice>
<fieldForLabel>id</fieldForLabel>
<fieldForValue>id</fieldForValue>
<search base="base_search_filter">
<query>search | dedup id
| table id</query>
</search>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="dropdown" token="status" searchWhenChanged="true">
<label>Status</label>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>status</fieldForLabel>
<fieldForValue>status</fieldForValue>
<search base="base_search_filter">
<query> search | dedup status
| table status</query>
</search>
</input>
</fieldset>
<row>
<panel>
<table>
<search base="base_search">
<query> search
| table id,  status,
</query>
</search>
<option name="drilldown">row</option>
</table>
</panel>
</row>
</form>
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Khushboo, you are filtering before extracting status field. Please try below;

<form>
<search id="base_search">
<query>
index=abc sourcetype=xyz earliest = $earliest$ latest = now()
id = $id$ level = $level$ 
| rex field=msg "\{\"status\"\:\s+\"(?&lt;status&gt;[^\"\}]+)"
| where status = $status$
| sort id asc
</query>
</search>
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="id" searchWhenChanged="true">
<label>Request Id</label>
<choice value="*">ALL</choice>
<fieldForLabel>id</fieldForLabel>
<fieldForValue>id</fieldForValue>
<search base="base_search_filter">
<query>search | dedup id
| table id</query>
</search>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="dropdown" token="status" searchWhenChanged="true">
<label>Status</label>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>status</fieldForLabel>
<fieldForValue>status</fieldForValue>
<search base="base_search_filter">
<query> search | dedup status
| table status</query>
</search>
</input>
</fieldset>
<row>
<panel>
<table>
<search base="base_search">
<query> search
| table id,  status,
</query>
</search>
<option name="drilldown">row</option>
</table>
</panel>
</row>
</form>

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

Khushboo
Explorer

It is throwing me error:
Error in 'where' command: The expression is malformed. An unexpected character is reached at '* '.

0 Karma
Get Updates on the Splunk Community!

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...