I am trying to create a view that creates a dynamically populated drop down list with all the virus names in the past 15 minutes. I tested my search query and it has a tabular formatted list of ThreatName in column1 and count in column2. However, when I input this query in my view though, I can see the Loading in my drop down list, but when it finishes, my list will only contain my static value. I have read the doc over and over again and even used the examples and I've had no luck. Can anyone see what I'm doing wrong here or if this is a known bug?
<module name="SearchSelectLister">
<param name="savedSearch">sourcetype="Sophos" | fields ThreatName | dedup ThreatName | stats count by ThreatName</param>
<param name="settingToCreate">series_setting</param>
<param name="earliest">-15m@m</param>
<param name="searchWhenChanged">False</param>
<param name="label">Threat Name</param>
<param name="searchFieldsToDisplay">
<list>
<param name="label">Threat Name</param>
<param name="value">ThreatName</param>
</list>
</param>
<param name="staticFieldsToDisplay">
<list>
<param name="label">MAL/Dorf-F</param>
<param name="value">MAL/Dorf-F</param>
</list>
</param>
</module>
... View more