Splunk Search

How to display field values in a dropdown?

New Member

I have a field extracted called "IP" , I want to display the values of IP in a dropdown . But I want to do it based on the host selected in the first dropdown .How can I do this ?

0 Karma

SplunkTrust
SplunkTrust

take a look at my answer here:
https://answers.splunk.com/answers/527016/how-to-create-a-dependent-dropdown-and-multivalue.html
i think it can help overcome your challenge

hope it helps

0 Karma

Communicator

Hi,

Edit your Host dropdown to add a token in token options, edit then the IP dropdown, in the Dynamic options, Add your query in Search String:

index="foo" host=$host_tok|s$ | stats count by "IP"

0 Karma

Influencer

What is your search for the IP drop down? You just use the host filter using the token from host drop down in your IP search.

0 Karma

New Member

This is the query I am using for IP drop down.
index=$index1$ host=$hostname$|dedup ip

0 Karma

Influencer

Looks like you are going in right direction. Is it not working?

0 Karma

New Member

Yes , I am not seeing any values in dropdown for IP

0 Karma

Influencer
  1. If you take the query and run it manually with index and host values, do you get results?
  2. Verify the token names
  3. Are there any errors?
  4. Did you see what is the search that got dispatched for your drop down? You should be able to find it in your activity-jobs. This should give you clues on why the search did not return any values to the drop down.
0 Karma