Splunk Search

Need help in Lookup tables being used to populate dropdown box.

theouhuios
Motivator

Hello,

I am trying to use a lookup table to populate my dropdown box. As of now the code is

 <input type="dropdown" token="Dept">
  <label>Department: </label>
  <default>*</default>
  <choice value="*">All</choice>
  <choice value="Systems">Systems</choice>
  <choice value="Agency">Agency</choice>
</input>

<input type="dropdown" token="Area">
  <label>Area: </label>
  <default>*</default>
  <choice value="*">All</choice>
  <choice value="Architecture and Engineering">Architecture and Engineering</choice>
  <choice value="Systems Technology">Systems Technology</choice>
  <choice value="Product Solutions">Product Solutions</choice>
  <choice value="Systems Projects">Systems Projects</choice>
  <choice value="Customer Connection Solutions">Customer Connection Solutions</choice>
  <choice value="Channel Support">Channel Support</choice>
  <choice value="General and Financial Services">General and Financial Services</choice>
  <choice value="Data &amp; Information Strategies">Data  and amp; Information Strategies</choice>
  <choice value="P&amp;C Claims Systems">P and amp;C Claims Systems</choice>
  <choice value="Customer Relationship Management">Customer Relationship Management</choice>
  <choice value="Not Defined">Not Defined</choice>
  <choice value="Product Solutions">Product Solutions</choice>
</input>

Now, I guess I need to use populatingSearch to use the lookup file. But I am in a fix on how to use it. I would need the department dropdown to show both systems and agency. At the same time I wan't the data in "Area" dropdown to populate according to which option is chosen in the "Deptartment" dropdown box. How do I do this?

Also, while defining the lookups, it asks for an output field. What label field do I need to mention in there? I am not looking to populate any data in the lookup file as I just want the dropdown box to populate the data from the csv.

This is the data which is in the lookup table and which needs to populate the second dropdown box when "Systems" is selected in the first dropdown box.

Systems ---> label
Architecture and Engineering
Systems Technology
Product Solutions
Systems Projects
Customer Connection Solutions
Channel Support
General and Financial Services
Data and amp; Information Strategies
P and amp;C Claims Systems
Customer Relationship Management
Product Solutions

Regards

theou

Tags (1)
0 Karma

lguinn2
Legend

Here is what I have done in the past to populate the dropdown. Assuming that you have a lookup called system-lookup
and the csv contains this:

system
Architecture and Engineering
Systems Technology
Product Solutions

Here is the dropdown code for simple XML:

 <input type="dropdown" token="system">
      <label>System</label>
         <choice value="*">Any</choice>
         <populatingSearch fieldForValue="system" fieldForLabel="system">
                      <![CDATA[ | inputlookup system-lookup ]]>
         </populatingSearch>
    </input>
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...