Splunk Search

How to add values dynamically from a search to a drop-down input?

guillecasco
Path Finder

Hey,

I have something like this for a drop-down in a Splunk dashboard:

<input type="dropdown" token="trouID" searchWhenChanged="true">
  <label>AssetID</label>
  <label>AssetID</label>
  <choice value="">All</choice>
  <choice value="1243bd9c9206">Aeroplane</choice>
  <choice value="4b10fbec">tractor</choice>
  <choice value="6cf817f5d">car</choice>
  <choice value="14a4f0">skate App</choice>

and every time a new value appears from a search, I have to manually add it. Is there a way in which new values can be added dynamically to the drop-down?

example of search:

 index=host....... |stats values (trouID)

thanks

Tags (3)
0 Karma

somesoni2
Revered Legend

Try this

 <input type="dropdown" token="trouID" searchWhenChanged="true">
   <label>AssetID</label>
  <choice value="*">All</choice>
      <search>
        <query>
          index=host....... |stats count by trouID | table trouID
        </query>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>trouID</fieldForLabel>
      <fieldForValue>trouID</fieldForValue>     
      <default>*</default>
    </input>
0 Karma

sundareshr
Legend

You can use a search to define the choices for a dropdown. See here for the how

http://docs.splunk.com/Documentation/Splunk/6.0/Viz/Buildandeditforms#Static_and_dynamic_inputs_to_f...

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...