How to format results and populate a dashboard dropdown filter with mcatalog?

[winknotes]

I'm trying to populate a dropdown filter with a mcatalog search to allow a user to select from a list of dimensions. The search works but the results are returned as a long string without line breaks between the items returned. I've been looking and looking for a solution but can't find anything. So I'm reaching out for help.

|mcatalog values(array_name) AS array_name WHERE index="my_index" 

I've tried many many options (eval, rex, table, and so on) to get the results formatted as a list that shows up properly in the dropdown. Thanks in advance.

[jacobpevans · Accepted solution]

mcatalog values(xyz) returns the list of all distinct values of the specified field as a multivalue entry (See here)

So, throw in a mvexpand to expand it out, e.g.

| mvexpand array_name

See here for more information regarding Splunk multivalue eval functions, specifically mvexpand

Alternatively, mcatalog has a BY parameter that may be useful to you.

[winknotes]

Brilliant!! So much to learn...so little time.

[jacobpevans]

You're welcome. Don't forget to mark this as the accepted answer if this solved your problem. If not, feel free to reply.