- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Is there a limit to the number of choices in a das...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there a limit to the number of choices in a dashboard drop-down?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The limit for more recent versions of Splunk 6.3 and higher is definitely in the tens of thousands. More than a few thousand will be noticeable in terms of the amount of memory a dashboard eats up.
200 should be no issue.
There is no override.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
how are you populating the drop down? I have had a dropdown of over 1000, and I am not sure of any limit, though depending on how it is populated, i have noticed lag times in the drop down being populated. Also, what version of Splunk are you using?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Using version 6.5.2 - This is the jist of my query in the dropdown |inputlookup datafile |sort+ app_names|dedup app_names? Any reason I am only get 55 of the 200+ dropdown application names?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
when you open the input to edit it in the dashboard and you click "Run Search" do you see 200+ app_names or just 55? is it because of the dedup?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do this |inputlookup datafile |stats dc(app_names) as unique and see what number you get
Also, I would change your original query to this: |inputlookup datafile |dedup app_names | sort + app_names
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
