Splunk Enterprise

help on a dropdown list from an lookup

jip31
Motivator

Hi

I retrieve the fields of a dropdown list from an CSV file

It works but the probleme I have is that randomnly I have the message "filling on going" which last and as a consequence I am unable to update the dashboards panels because each panels are referenced to this dropdown list

there is 1300 lines in my csv file

What is the problem please?

 <input type="dropdown" token="site" searchWhenChanged="true">
      <label>Site</label>
      <fieldForLabel>site</fieldForLabel>
      <fieldForValue>site</fieldForValue>
      <search>
        <query>| inputlookup site.csv</query>
      </search>
      <choice value="*">*</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>

  

Labels (1)
Tags (1)
0 Karma
1 Solution

Gr0und_Z3r0
Contributor

Try using stats in your dropdown to show the dropdown value...

Something like this... 

| inputlookup site.csv
| stats dc(site) by site


Splunk's dropdown can only show up to 1000 rows rest are shown as you type in... 

View solution in original post

0 Karma

Gr0und_Z3r0
Contributor

Try using stats in your dropdown to show the dropdown value...

Something like this... 

| inputlookup site.csv
| stats dc(site) by site


Splunk's dropdown can only show up to 1000 rows rest are shown as you type in... 

0 Karma

Gr0und_Z3r0
Contributor

Its not a good idea to have such a long dropdown. It will not be efficient at all. Maybe if you could subdivide the dropdowns into multiple sites. Cascading dropdowns... where the second site dropdown is derived based on the 1st dropdown
Region -> Site
Or Use text input field to match and drive your dashboard search panels.

A similar question was asked earlier in the forum.

https://community.splunk.com/t5/Dashboards-Visualizations/What-is-the-maximum-limitation-of-drop-dow... 

0 Karma

jip31
Motivator

I understand but this example can't be applicable for me

So is it better to continue o use a csv lookup in the dropdown list or to use an inline search directly?

I am just speaking about performances

Thanks

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...