A quick way would be to populate the drop down from a populatingSearch (below). This example terminates the populating search once 1000 values are retrieved (via the "head 1000" command).
<form> <label>populate_dropdown_from_search</label> <fieldset submitButton="false"> <input type="dropdown" token="channel_code"> <label>Name:</label> <populatingSearch fieldForLabel="name" fieldForValue="name">index=main sourcetype=mainperfomance ChannelCode=* | head 1000 | stats count by ChannelCode | fields - count</populatingSearch> </input> </fieldset> <row> <panel> <event> <searchString>index=main sourcetype=mainperfomance ChannelCode=$channel_code$</searchString> <earliestTime/> <latestTime/> </event> </panel> </row> </form>
A more robust solution is to define a lookup and then create a scheduled saved search that updates that lookup file. That file is updated by a search similar to the populating search. The lookup can then be used to populate the dropdown box quickly. Using a search that appends the lookup with new values makes the list more robust over time:
index=main sourcetype=mainperfomance ChannelCode=* | inputlookup append=t channel_codes | stats count by ChannelCode | fields - count | outputlookup channel_codes
...then you would modify the dashboard to load the results from that looup file:
<populatingSearch fieldForLabel="name" fieldForValue="name">| inputlookup channel_codes</populatingSearch>
If you're using latest version of Splunk, much of the work (creating the form, adding the dropdown, adding a populating search, etc) can be done via the UI's dashboard editor. Additionally, this app has many great Simple XML dashboard examples: http://apps.splunk.com/app/1603/