How to display field values in a dropdown?

[navd]

I have a field extracted called "IP" , I want to display the values of IP in a dropdown . But I want to do it based on the host selected in the first dropdown .How can I do this ?

[adonio]

take a look at my answer here:
https://answers.splunk.com/answers/527016/how-to-create-a-dependent-dropdown-and-multivalue.html
i think it can help overcome your challenge

hope it helps

[amiftah]

Hi,

Edit your Host dropdown to add a token in token options, edit then the IP dropdown, in the Dynamic options, Add your query in Search String:

index="foo" host=$host_tok|s$ | stats count by "IP"

[pradeepkumarg]

What is your search for the IP drop down? You just use the host filter using the token from host drop down in your IP search.

[navd]

This is the query I am using for IP drop down.
index=$index1$ host=$hostname$|dedup ip

[pradeepkumarg]

Looks like you are going in right direction. Is it not working?

[navd]

Yes , I am not seeing any values in dropdown for IP

[pradeepkumarg]

1. If you take the query and run it manually with index and host values, do you get results?
2. Verify the token names
3. Are there any errors?
4. Did you see what is the search that got dispatched for your drop down? You should be able to find it in your activity-jobs. This should give you clues on why the search did not return any values to the drop down.