Populate dropdown form field values from a file

[sranga]

Hi

I was wondering if its possible to populate the values for a dropdown field of a form from a file through a lookup command.

The current setup uses the populatingSearch feature and it is very slow. I don't want to add all of the values to the form field as <choice> tags.

Thanks for your help.

Ranga

[sideview]

Yes this is possible and its a great way to do it.

Assuming you're working with a simplified XML view, (ie where your outer tag is <form>), its extremely easy. It's really just a matter of using the inputlookup command in the element.

See here for general discussion of how to configure a pulldown that gets its values from any search. and just picture the search in question starting with the inputlookup command. http://www.splunk.com/base/Documentation/latest/Developer/AddDropDowns

As always, remember to test out the search commands in the search UI to make sure you understand what it's doing and that the fields are coming out right.

Also, if you're using the advanced XML already, the developer manual actually has an example written up about this topic specifically:

http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/LookupsAndViews

[ChrisG]

The updated doc location for creating dropdowns in Splunk 5.0 is http://docs.splunk.com/Documentation/Splunk/5.0/Viz/Exampleform#Create_a_dynamic_form_search_using_d...

[gkanapathy · Accepted solution]

You can use the | inputlookup command to get the contents of a lookup file into your populatingSearch

[Johnvey]

Generally, yes. The inputlookup, at its simplest, just reads lines in from a CSV file so it's about as fast as it gets. Savedsearch can be just as fast if there is a previously scheduled job artifact available -- otherwise a new search will be kicked off.

[sranga]

Thanks. Is this faster than a | savedsearch?