I'm trying to populate my drop down list with extracted fields of a search, most examples I've seen on splunkbase explain it quite well, but I don't think I'm getting the syntax right, how do I set the 'fields' as the token to pass to my populating search? I currently have this:
<! -- default search to assign tokens --->
index=main host=gridnames | fields gridnames | dedup gridnames <!- set $grid$ here: HOW?>
<![CDATA[index="main" host=gridnames| fields grid | dedup grid]]>
I know I'm not setting $grid$ in the searchtemplate, but how do I do it for the field gridnames?
... View more