Hi All,
I am preparing a dashboard where in I want to place a dropdown and I want to pick the following query output in the dropdown
"select book_type_code from fa_deprn_periods where period_name='JAN-09'" .
I have done the following and it is showing nothing in the dropbox.
I found another solution for this . Using Lookup you can achieve the same.
follow the following steps
1) Create a csv file in the following location "Splunk homeetcappsdbxlookups lets say the file is "user.csv".Make sure u must have some data in the CSV file.Else if u chk my code I am creating a CSV from dbquery with the help of | outputlookup command.
2) Create a new lookup from Settings--->Lookups-->Lookup table file here select the same csv file which u have created u can choose the same file name in the destination lets say the name is "vikaslookup".
3) Make sure u chkd the permissions it should be global.
4) Now open splunk and type the following code and that is it.
I found another solution for this . Using Lookup you can achieve the same.
follow the following steps
1) Create a csv file in the following location "Splunk homeetcappsdbxlookups lets say the file is "user.csv".Make sure u must have some data in the CSV file.Else if u chk my code I am creating a CSV from dbquery with the help of | outputlookup command.
2) Create a new lookup from Settings--->Lookups-->Lookup table file here select the same csv file which u have created u can choose the same file name in the destination lets say the name is "vikaslookup".
3) Make sure u chkd the permissions it should be global.
4) Now open splunk and type the following code and that is it.
Just to be sure, check the field name returned by query when ran manually in search is matching fieldForValue and fieldForLabel values, including case
Linu
While pasting this code in the above section I manually delete the database name , but it is there in the actual code and sql query is returning results that I have checked .
I do not have much idea about Cdata and I am not sure if I can use dbquery in CSDATA...Please suggest
You need to follow proper case when creating the view definition, Proper capitalization where ever needed. Have given the sample for you.
<form>
<fieldset>
<input type="dropdown" searchWhenChanged="true" token="drop">
<populatingSearch fieldForValue="book_type_code" fieldForLabel="book_type_code">
<![CDATA[| dbquery database_name "select book_type_code from fa_deprn_periods where period_name='JAN-09'"]]>
</populatingSearch>
</input>
</fieldset>
</form>
Thanks