Splunk Search

How to feed a dropdown list from the search linked to this fropdown list

jip31
Motivator

Hi

As you can see in my XML I use a dropdown list which is feeded from a csv file

I would like to be able to feed this dropdown list from the stats command there is in my search (stats last(RESPONSIBLE_USER) as "Responsible") in order to have just the "Responsible" items corresponding to my search

How to do this please?

<form stylesheet="format.css">
  <label>Battery</label>...<fieldset submitButton="true">
       <input type="dropdown" token="tok_filterresponsible" searchWhenChanged="true">
      <label>Responsible</label>
      <choice value="*">*</choice>
      <initialValue>*</initialValue>
      <default>*</default>
      <fieldForLabel>RESPONSIBLE_USER</fieldForLabel>
      <fieldForValue>RESPONSIBLE_USER</fieldForValue>
      <search>
        <query>| inputlookup responsible.csv</query>
      </search>
    </input>
  </fieldset>
 
  <row>
    <panel>
      <table>
        <title>/title>
        <search>
          <query>| inputlookup fo_all 
| rename HOSTNAME as host 
| lookup lookup_pana"name0" as host OUTPUT BatteryTemp0 BatteryModel0 CycleCount0 HealthState0 LastRecalibration0 ManufactureDate0 DesignCapacity0 
| lookup lookup_cmdb_fo_all HOSTNAME as host output SITE RESPONSIBLE_USER DEPARTMENT 
| search RESPONSIBLE_USER=$tok_filterresponsible|s$ 
| stats last(RESPONSIBLE_USER) as "Responsible", last(DEPARTMENT) as Department, last(SITE) as Site, last(BatteryModel0) as "Battery model", last(DesignCapacity0) as "Design capacity (mAH)", last(HealthState0) as "Health state (%)", last(CycleCount0) as "Cycle count", 
    last(ManufactureDate0) as "Manufacture date", last(LastRecalibration0) as "Last recalibration" by host 
| rename host as Hostname 

As 

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Where is your list of responsible users held? Can you try:

      <search>
        <query>| inputlookup lookup_cmdb_fo_all | fields RESPONSIBLE_USER | dedup RESPONSIBLE_USER</query>
      </search>
0 Karma

jip31
Motivator

no

its what I do actually except that I export the result in a lookup (see my code)

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are you saying you use

| inputlookup fo_all 
| rename HOSTNAME as host 
| lookup lookup_pana"name0" as host OUTPUT BatteryTemp0 BatteryModel0 CycleCount0 HealthState0 LastRecalibration0 ManufactureDate0 DesignCapacity0 
| lookup lookup_cmdb_fo_all HOSTNAME as host output SITE RESPONSIBLE_USER DEPARTMENT

to create responsible.csv? If so, why can't you use this query to populate your dropdown (you might want to add fields RESPONSIBLE_USER | dedup RESPONSIBLE_USER)

0 Karma

jip31
Motivator

no i use

| inputlookup fo_all 
| dedup RESPONSIBLE_USER 
| table RESPONSIBLE_USER
| sort + RESPONSIBLE_USER
| outputlookup responsible.csv

My question is how to retrieve the "Responsible" field that is stats  in my search in my dropdown list

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am still unsure what you are asking for but can you change the query in your dropdown to

| inputlookup fo_all 
| rename HOSTNAME as host 
| lookup lookup_pana"name0" as host OUTPUT BatteryTemp0 BatteryModel0 CycleCount0 HealthState0 LastRecalibration0 ManufactureDate0 DesignCapacity0 
| lookup lookup_cmdb_fo_all HOSTNAME as host output SITE RESPONSIBLE_USER DEPARTMENT 
| stats last(RESPONSIBLE_USER) as RESPONSIBLE_USER by host 
| fields RESPONSIBLE_USER
| dedup RESPONSIBLE_USER

If so, why doesn't this do the same thing?

| inputlookup fo_all 
| lookup lookup_cmdb_fo_all HOSTNAME output SITE RESPONSIBLE_USER DEPARTMENT 
| stats last(RESPONSIBLE_USER) as RESPONSIBLE_USER by HOSTNAME 
| fields RESPONSIBLE_USER
| dedup RESPONSIBLE_USER
0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...