I have a dashboard that automatically populates a drop-down based on a search with CDATA. I want to be able to actually type into the box, say a specific IP, and as I'm typing it, have it do an on-demand filter. The closest I've been able to do is a "multi-select" input instead of a drop-down. Does anyone know the easiest way to do this?
For Splunk 6.1.X version, multiselect is option to get the dropdown with text field. This feature is available (brought back) in Splunk 6.2
In Splunk 6.2, this is possible . When you type for example a specific sourcetype in my case, the input will automatically filter the sourcetype who macth to that sourcetype. My XML code with CDATA! is:
<form> <label>Dashboard_Filter</label> <fieldset submitButton="false"> <input type="dropdown" token="sourcetype" searchWhenChanged="true"> <label>Select Sourcetype</label> <search> <query><![CDATA[index=_internal | table sourcetype]]></query> </search> <fieldForLabel>sourectype</fieldForLabel> <fieldForValue>sourcetype</fieldForValue> <prefix>sourcetype="</prefix> <suffix>"</suffix> </input> </fieldset> <row> <panel> <table> <search> <query>index=_internal | stats count by sourcetype</query> <earliest></earliest> <latest></latest> </search> </table> </panel> </row> </form>