Dashboards & Visualizations

Dropdown field not getting populated by populatingSearch

asherman
Path Finder

Hi,

The following code produces results (via searchTemplate), but does not populate my dropdown menu. Data is stored as lines of comma delimited key=value pairs, e.g., colour=red,block=lab,corner=100c. Note that the searches are identical for the searchTemplate and populatingSearch inputs.

index=test_index3 | fields block | dedup block | stats values(block)
All index=test_index3 | fields block | dedup block | stats values(block) *
$blocks$

Am I misusing the dropdown/populatingSearch syntax somehow?

1 Solution

aweitzman
Motivator

Use table block instead of stats values(block) after the dedup block phrase of the populating search.

View solution in original post

aweitzman
Motivator

Use table block instead of stats values(block) after the dedup block phrase of the populating search.

surekhasplunk
Communicator

am using below code

  <label>Email ID</label>
  <search>
    <query>index=snow description=*CPU* number=INC0010007 | table sys_created_by</query>
    <earliest>0</earliest>
    <latest></latest>
  </search>
  <fieldForLabel>emailid</fieldForLabel>
  <fieldForValue>emailid</fieldForValue>
</input>

but my dropdown isn't getting populated whereas the query gives me result.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...