Is there a upper limit to dashboard dropdown value fetch from lookup file

[manas]

I have a lookup file . It has 2 columns : Service and Entity and 500+ rows. Service has 34 unique values and Entity has 164. 

I have a dashboard where for search i want to use values from this lookup as input to search criteria. I have following logic .I get the dropdown values for "service" without any issues but not for "entity" when it's same lookup file ,same logic.

Any ideas ?

Snippet :

<input type="dropdown" token="Service" searchWhenChanged="true">
<label>Service</label>
<search>
<query>
|inputlookup metadata.csv | dedup service
| stats dc(service) by service
</query>
</search>
<choice value="*">*</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>

<input type="dropdown" token="Entity" searchWhenChanged="true">
<label>Entity</label>
<search>
<query>
|inputlookup metadata.csv | dedup entity
| stats dc(entity) by entity
</query>
</search>
<choice value="*">*</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>

[manas]

Or is it possible that issue is related to same lookup file being referenced for next input dropdown subsequently causing issue.

[gcusello · Accepted solution]

Hi @manas,

at first you culd simplify your searches:

e.g. the first:

| inputlookup metadata.csv 
| dedup service
| sort service
| table service

then in the second dropdown you could use the result of the first to filter results in this way:

<input type="dropdown" token="Service" searchWhenChanged="true">
   <label>Service</label>
   <search>
      <query>
         | inputlookup metadata.csv 
         | dedup service
         | sort service
         | table service
      </query>
   </search>
   <choice value="*">*</choice>
   <default>*</default>
   <initialValue>*</initialValue>
</input>

<input type="dropdown" token="Entity" searchWhenChanged="true">
   <label>Entity</label>
   <search>
      <query>
         | inputlookup metadata.csv WHERE Service="$Service$"
         | dedup entity
         | sort entity
         | table entity
      </query>
   </search>
   <choice value="*">*</choice>
   <default>*</default>
   <initialValue>*</initialValue>
</input>

Ciao.

Giuseppe

[gcusello]

Hi @manas,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉