Splunk Search

Populating search not working

theouhuios
Motivator

Hello

I am trying to autopopulate the below input type and its not giving any data in the dropbox. Can anyone please tell me where am I doing a mistake?



*
<![CDATA[earliest=-31d@d sourcetype="incident"|stats count by record.groupArea]]>

alt text

<?xml version='1.0' encoding='utf-8'?>






Reactionary
Cautionary

<input type="dropdown" token="Dept">
  <label>Department: </label>
  <default>*</default>
  <choice value="*">All</choice>
  <choice value="Systems">Systems</choice>
  <choice value="Agency">Agency</choice>
</input>
<input type="dropdown" token="Area">
  <label>Area: </label>
  <default>*</default>
   <populatingSearch fieldforvalue="Area" fieldforlabel="Area"> <![CDATA[earliest=-31d@d sourcetype="incident"|rename record.groupArea as Area |stats count by Area]]> </populatingSearch>
</input>

<input type="text" token="WG">
  <label>WorkGroup: </label>
  <default>*</default>
</input>
<input type="text" token="CI">
  <label>CI: </label>
  <default>*</default>
</input>


Tags (1)
0 Karma

srowe
Explorer

also, autorun should be "autoRun" camel case. It took me awhile to realize that!

0 Karma

rroberts
Splunk Employee
Splunk Employee

Should be upper case S in populatingSearch

0 Karma

rroberts
Splunk Employee
Splunk Employee

Did you have any luck?

0 Karma

rroberts
Splunk Employee
Splunk Employee

Check case sensitivity:

fieldForValue= fieldForLabel=

0 Karma

theouhuios
Motivator

Updated the initial post. I did try to change the name and try it but it doesn't work.

0 Karma

rroberts
Splunk Employee
Splunk Employee

Trying to recreate. Can you add the entire form XML please?

0 Karma

theouhuios
Motivator

Any help??

0 Karma

rroberts
Splunk Employee
Splunk Employee

I think it might be a problem with the . in the field name.

0 Karma

theouhuios
Motivator

That removes the error, but there is no data being populated in the dropdown. Updating the first post with the image of the data

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...