Splunk Search

Is there a upper limit to dashboard dropdown value fetch from lookup file

manas
Explorer

I have a lookup file . It has 2 columns : Service and Entity and 500+ rows. Service has 34 unique values and Entity has 164. 

I have a dashboard where for search i want to use values from this lookup as input to search criteria. I have following logic .I get the dropdown values for "service" without any issues but not for "entity" when it's same lookup file ,same logic.

 

Any ideas ?

Snippet :

<input type="dropdown" token="Service" searchWhenChanged="true">
<label>Service</label>
<search>
<query>
|inputlookup metadata.csv | dedup service
| stats dc(service) by service
</query>
</search>
<choice value="*">*</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>

<input type="dropdown" token="Entity" searchWhenChanged="true">
<label>Entity</label>
<search>
<query>
|inputlookup metadata.csv | dedup entity
| stats dc(entity) by entity
</query>
</search>
<choice value="*">*</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @manas,

at first you culd simplify your searches:

e.g. the first:

| inputlookup metadata.csv 
| dedup service
| sort service
| table service

then in the second dropdown you could use the result of the first to filter results in this way:

<input type="dropdown" token="Service" searchWhenChanged="true">
   <label>Service</label>
   <search>
      <query>
         | inputlookup metadata.csv 
         | dedup service
         | sort service
         | table service
      </query>
   </search>
   <choice value="*">*</choice>
   <default>*</default>
   <initialValue>*</initialValue>
</input>

<input type="dropdown" token="Entity" searchWhenChanged="true">
   <label>Entity</label>
   <search>
      <query>
         | inputlookup metadata.csv WHERE Service="$Service$"
         | dedup entity
         | sort entity
         | table entity
      </query>
   </search>
   <choice value="*">*</choice>
   <default>*</default>
   <initialValue>*</initialValue>
</input>

Ciao.

Giuseppe

View solution in original post

0 Karma

manas
Explorer

Or is it possible that issue is related to same lookup file being referenced for next input dropdown subsequently causing issue.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @manas,

at first you culd simplify your searches:

e.g. the first:

| inputlookup metadata.csv 
| dedup service
| sort service
| table service

then in the second dropdown you could use the result of the first to filter results in this way:

<input type="dropdown" token="Service" searchWhenChanged="true">
   <label>Service</label>
   <search>
      <query>
         | inputlookup metadata.csv 
         | dedup service
         | sort service
         | table service
      </query>
   </search>
   <choice value="*">*</choice>
   <default>*</default>
   <initialValue>*</initialValue>
</input>

<input type="dropdown" token="Entity" searchWhenChanged="true">
   <label>Entity</label>
   <search>
      <query>
         | inputlookup metadata.csv WHERE Service="$Service$"
         | dedup entity
         | sort entity
         | table entity
      </query>
   </search>
   <choice value="*">*</choice>
   <default>*</default>
   <initialValue>*</initialValue>
</input>

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @manas,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated :winking_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...