All Apps and Add-ons

Populating drop down from lookup table

ahogbin
Communicator

Hello..

I am attempting to use a lookup table to populate a drop down box which will then be used to feed into a search. The lookup table has 3 columns one of which is titled BROKER


| inputlookup Safire_Broker.csv | dedup BROKER

  <module name="Pulldown">
    <param name="name">BROKER</param>
    <param name="label">Broker Name:</param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="value">$name$</param>
      </list>
    </param>
  </module>
</module>

The problem that am having is that the drop down does not seem to be recognising the search and all that I get is a drop down box that "loading".

I have verified that the file name is correct using the search | inputlookup Safire_Broker.csv and the table returned is correct

For whatever reason it would appear that my dashboard drop down is not recognising the lookup table and I am at a loss as to know why.

If I use the standard xml search




*
Any


| inputlookup Safire_Broker.csv | dedup BROKER

BROKERS
BROKER_setting
False


BROKER
BROKER


All works as expected... I am puzzled as to why the first query does not work yet the second works perfectly. I must be missing something but cannot for the life of me figure out what.

1 Solution

sideview
SplunkTrust
SplunkTrust

You just need to put an autoRun="True" onto that initial Search module. That will kick off the cascading push, which will cause the search to be dispatched, which then causes the Pulldown to render.

With a Table module you sort of expect it to sit there and not render with no autoRun="True". With a Pulldown people often have the opposite expectation, but all of the Sideview modules behave that way - without some user-initiated push (like clicking a green button or hitting return in a TextField), or a autoRun="True" push from somewhere upstream, it'll all just sit there.

View solution in original post

sideview
SplunkTrust
SplunkTrust

You just need to put an autoRun="True" onto that initial Search module. That will kick off the cascading push, which will cause the search to be dispatched, which then causes the Pulldown to render.

With a Table module you sort of expect it to sit there and not render with no autoRun="True". With a Pulldown people often have the opposite expectation, but all of the Sideview modules behave that way - without some user-initiated push (like clicking a green button or hitting return in a TextField), or a autoRun="True" push from somewhere upstream, it'll all just sit there.

ahogbin
Communicator

Perfect.. I cannot believe it was something so simple 🙂

Thank you as always for your help.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...