Dashboards & Visualizations

Simple Dropdown

DTERM
Contributor

I'm trying to create a dropdown based on the following query:

index=MyApp tgtHostname=$tgtHostname$

The form is there and the default value of "any" seems to work. However the dropdown is not populated. Any idea why? Thanks.

<form>
  <label>My form search</label>
  <searchTemplate>index=MyApp tgtHostname=$tgtHostname$</searchTemplate>

  <fieldset>
    <input type="dropdown" token="tgtHostname">
       <label>Select the hostname</label>
       <populatingSearch fieldForValue="tgtHostname" fieldForLabel="tgtHostname"><![CDATA[index=MyApp tgtHostname=$tgtHostname$]]></populatingSearch>
     <default>somehost.somedomain.com</default>
     <choice value="*">Any</choice>
    </input>
  </fieldset>

  <row>
   <table>
     <title>Host Names</title>
     <option name="showPager">true</option>
   </table>
   </row>
</form>
Tags (1)
0 Karma
1 Solution

RicoSuave
Builder
<form>
<label>My form search</label> 
<searchTemplate>index=MyApp tgtHostname=$tgtHostname$</searchTemplate> 
<fieldset> 
 <input type="dropdown" token="tgtHostname"> 
   <label>Select the hostname</label> 
     <populatingSearch fieldForValue="tgtHostname" fieldForLabel="tgtHostname"><![CDATA[index=MyApp | stats count by tgtHostname]]></populatingSearch> 
     <default>somehost.somedomain.com</default> 
     <choice value="*">Any</choice> 
 </input> 
</fieldset> 
<row> 
<title>Host Names</title> 
<option name="showPager">true</option>
</row> 
</form>

View solution in original post

RicoSuave
Builder
<form>
<label>My form search</label> 
<searchTemplate>index=MyApp tgtHostname=$tgtHostname$</searchTemplate> 
<fieldset> 
 <input type="dropdown" token="tgtHostname"> 
   <label>Select the hostname</label> 
     <populatingSearch fieldForValue="tgtHostname" fieldForLabel="tgtHostname"><![CDATA[index=MyApp | stats count by tgtHostname]]></populatingSearch> 
     <default>somehost.somedomain.com</default> 
     <choice value="*">Any</choice> 
 </input> 
</fieldset> 
<row> 
<title>Host Names</title> 
<option name="showPager">true</option>
</row> 
</form>

RicoSuave
Builder

Watch your syntax as well. It's not shown here since the code sample widget didn't work for me, but make sure you have an upper Case T in searchTemplate, Uppercase F and L in fieldForLabel and uppercase F and V in fieldForValue

0 Karma

RicoSuave
Builder

I have no clue why the code sample box isn't working for me, but that should do it for you.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...