I have a question regarding the population of dropdowns via saved searches.
The examples in the Splunk documentation show a search similar to the following:
<populatingSearch fieldForValue="suser" fieldForLabel="suser"><!CDATA[sourcetype=p4change | rex "user=(?<suser>\w+)@" | stats count by suser]]></populatingSearch>
However, I am slightly confused (maybe because the search in the examples is quite complex) on how this is carried out in practice.
I wish to populate the dropdown with the contents of the partner field which has up to 200 different values within the indexed data. The string being as follows:
How would I write the example population string in a way which can parse my indexed data in a way that could populate the dropdown?
<populatingSearch fieldForValue="partner" fieldForLabel="partner">
sourcetype=your_sourcetype | fields partner | dedup partner
View solution in original post
Brilliant! That works a treat