Splunk Enterprise

help on a dropdown list from an lookup

jip31
Motivator

Hi

I retrieve the fields of a dropdown list from an CSV file

It works but the probleme I have is that randomnly I have the message "filling on going" which last and as a consequence I am unable to update the dashboards panels because each panels are referenced to this dropdown list

there is 1300 lines in my csv file

What is the problem please?

 <input type="dropdown" token="site" searchWhenChanged="true">
      <label>Site</label>
      <fieldForLabel>site</fieldForLabel>
      <fieldForValue>site</fieldForValue>
      <search>
        <query>| inputlookup site.csv</query>
      </search>
      <choice value="*">*</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>

  

Labels (1)
Tags (1)
0 Karma
1 Solution

Gr0und_Z3r0
Contributor

Try using stats in your dropdown to show the dropdown value...

Something like this... 

| inputlookup site.csv
| stats dc(site) by site


Splunk's dropdown can only show up to 1000 rows rest are shown as you type in... 

View solution in original post

0 Karma

Gr0und_Z3r0
Contributor

Try using stats in your dropdown to show the dropdown value...

Something like this... 

| inputlookup site.csv
| stats dc(site) by site


Splunk's dropdown can only show up to 1000 rows rest are shown as you type in... 

0 Karma

Gr0und_Z3r0
Contributor

Its not a good idea to have such a long dropdown. It will not be efficient at all. Maybe if you could subdivide the dropdowns into multiple sites. Cascading dropdowns... where the second site dropdown is derived based on the 1st dropdown
Region -> Site
Or Use text input field to match and drive your dashboard search panels.

A similar question was asked earlier in the forum.

https://community.splunk.com/t5/Dashboards-Visualizations/What-is-the-maximum-limitation-of-drop-dow... 

0 Karma

jip31
Motivator

I understand but this example can't be applicable for me

So is it better to continue o use a csv lookup in the dropdown list or to use an inline search directly?

I am just speaking about performances

Thanks

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...