Hi Splunkers,
I'm trying to build my first dashboard and I've hit a wall, I can't find any mention of this elsewhere, can anyone help?
I'm trying to make a multiselect input with all elements from a search, and dynamically select 10 of them (based on a field in the search).
I get a list of all the elements in the list from:
index=* | fields spID | dedup spID
I can get the ones I want selected using:
index=* | stats count(spID) as auths by spID | sort -auths limit=10
(this then spills over into a chart)
the code I have so far is:
<input type="multiselect" token="spPicker" searchWhenChanged="true"> <label>spPicker</label> <fieldForLabel>spID</fieldForLabel> <fieldForValue>spID</fieldForValue> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <search> <query>index=* | fields spID | dedup spID</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <delimiter>,</delimiter> </input>
So this half works - all the elements are present in the list. I don't see a way of auto selecting the top 10 - I've tried <defaults> and <initialValues>, but these both want a static list. Any ideas anyone?
thanks in advance,
Jim
... View more