Using splunk enterprise 9.4.3 and dashboard studion. I'm trying to populate a drop down on a dashboard with a search query as follows: `bsod`
| stats values(fct_version) as ForticlientVersion This returns the values as desired as will do so for any time period as the events will always have this field. When I confgure the drop down dynamic fields as follows: The dashboard does not display these values in the drop down ever (afer refresh etc.) Code for dropdown: {
"context": {
"formattedConfig": {
"number": {
"prefix": ""
}
},
"formattedStatics": ">statics | formatByType(formattedConfig)",
"label": ">primary | seriesByName(\"ForticlientVersion\") | renameSeries(\"label\") | formatByType(formattedConfig)",
"statics": [
[
"All"
],
[
"*"
]
],
"value": ">primary | seriesByName(\"ForticlientVersion\") | renameSeries(\"value\") | formatByType(formattedConfig)"
},
"dataSources": {
"primary": "ds_GS8EDN3O"
},
"options": {
"defaultValue": "*",
"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
"token": "_ftcversion"
},
"title": "Forticlient Version",
"type": "input.dropdown"
}
... View more