So I have a dropdown called Repository, that populates a search and another dropdown called Namespace that has set choices. I only want there to be options if a certain Repository, "strawman" is chosen. Is there a way I can do that with populating search for the Namespace option? Here is my Simple XML, also the company I work for is really big on security so I can't do any Javascript and I'd rather stick to Simple XML <input type="dropdown" token="repository" searchWhenChanged="true"> <label>Repository:</label> <default>strawman</default> <choice value="*">Any</choice> <populatingSearch fieldForValue="repository" fieldForLabel="repository"> <![CDATA[index = git earliest="01/01/2009:20:00:00" latest=now() |table Data.payload.repository.name | dedup Data.payload.repository.name | sort Data.payload.repository.name | rename Data.payload.repository.name AS repository]]> </populatingSearch> </input> <input type="dropdown" token="namespace" searchWhenChanged="true"> <label>Namespace: (Strawman Rep. Only)</label> <default>*</default> <choice value="*">Any</choice> <choice value="Payments/">Payments</choice> <choice value="Invoicing/">Invoicing</choice> <choice value="Network/">Networking</choice> </input> Or is there a way I can have my searches just wildcard the $namespace$ option if $repository$ doesn't equal "strawman"? Here is my search: Index=git OR index=git "Data.payload.head_commit.modified{}" = "*$namespace$*" "Data.payload.head_commit.modified{}" = "*$file$*" "Data.payload.head_commit.modified{}" = "*$extension$" "Data.payload.repository.name" = "*$repository$*" | table Data.payload.head_commit.committer.name |stats count by Data.payload.head_commit.committer.name | dedup Data.payload.head_commit.committer.name | sort by -count | rename Data.payload.head_commit.committer.name as "Committer Name" | head 20 ... View more

So I've searched the Splunk answers over and over, and read up on subsearches, but I must not be getting something quite right. So I've got a subsearch (with the assumption that they are performed first) to search all events for a particular context Id, 123456, and then grabs the PaymentId from that event, and performs the outside search for events with the already found PaymentId, and then can get the fields from that event in a table, as shown below. What am I missing? Data.Response.Payments{}.PaymentId = Data.Request.Payments{}.PaymentId [search ContextId = fcdc6c40-4ebe-4d0f-9481-ebb1701a6aae Pipeline = "RR" | fields + Data.Request.Payments{}.PaymentId] | table Data.Response.TotalPayablesCount ... View more