Splunk Search

Populating search not working

theouhuios
Motivator

Hello

I am trying to autopopulate the below input type and its not giving any data in the dropbox. Can anyone please tell me where am I doing a mistake?



*
<![CDATA[earliest=-31d@d sourcetype="incident"|stats count by record.groupArea]]>

alt text

<?xml version='1.0' encoding='utf-8'?>






Reactionary
Cautionary

<input type="dropdown" token="Dept">
  <label>Department: </label>
  <default>*</default>
  <choice value="*">All</choice>
  <choice value="Systems">Systems</choice>
  <choice value="Agency">Agency</choice>
</input>
<input type="dropdown" token="Area">
  <label>Area: </label>
  <default>*</default>
   <populatingSearch fieldforvalue="Area" fieldforlabel="Area"> <![CDATA[earliest=-31d@d sourcetype="incident"|rename record.groupArea as Area |stats count by Area]]> </populatingSearch>
</input>

<input type="text" token="WG">
  <label>WorkGroup: </label>
  <default>*</default>
</input>
<input type="text" token="CI">
  <label>CI: </label>
  <default>*</default>
</input>


Tags (1)
0 Karma

srowe
Explorer

also, autorun should be "autoRun" camel case. It took me awhile to realize that!

0 Karma

rroberts
Splunk Employee
Splunk Employee

Should be upper case S in populatingSearch

0 Karma

rroberts
Splunk Employee
Splunk Employee

Did you have any luck?

0 Karma

rroberts
Splunk Employee
Splunk Employee

Check case sensitivity:

fieldForValue= fieldForLabel=

0 Karma

theouhuios
Motivator

Updated the initial post. I did try to change the name and try it but it doesn't work.

0 Karma

rroberts
Splunk Employee
Splunk Employee

Trying to recreate. Can you add the entire form XML please?

0 Karma

theouhuios
Motivator

Any help??

0 Karma

rroberts
Splunk Employee
Splunk Employee

I think it might be a problem with the . in the field name.

0 Karma

theouhuios
Motivator

That removes the error, but there is no data being populated in the dropdown. Updating the first post with the image of the data

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Developer Spotlight with Denis Gladkikh

From Splunk Engineer to Kubernetes App Builder Denis GladkikhWhat happens when a lifelong developer turns a ...

Governing Enterprise AI, Bringing Cisco Telemetry Home, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...