Dashboards & Visualizations

Cascading Splunk dropdown will not populate on the first selection but will on the second?

smashedpumpkins
Explorer

Hey folks, I hope you can help me out as I'm stumped. I have a cascading dropdown menu. The 2nd dropdown menu relies on the first to obtain its variables. When I load the page, the first dropdown menu populates with no issue. When I make a selection with the first dropdown menu the second dropdown menu does not populate. If I select a different item in the first dropdown menu, after having already made my first selection, the second dropdown menu populates just fine. It does not matter which item I select in the first drop down menu, the issue always occurs.

<input type="dropdown" token="UCID">
  <label>Select Item</label>
  <default>Default Item 1</default>
  <populatingSearch fieldForValue="UCID" fieldForLabel="UCID">
    <![CDATA[|inputlookup item_1_lookup | fields "Use Case" | rename "Use Case" AS "UCID" | uniq "UCID" | sort "UCID"]]>
  </populatingSearch>
</input>
<input type="dropdown" token="FNAME">
  <label>Select Sub-item</label>
  <default>*</default>
  <populatingSearch fieldForValue="FNAME" fieldForLabel="FNAME">
    <![CDATA[|inputlookup item_1_lookup | search "Use Case"="$UCID$" | fields "Field Name" | rename "Field Name" AS "FNAME" | sort "FNAME"]]>
  </populatingSearch>
</input>
Tags (2)
0 Karma
1 Solution

smashedpumpkins
Explorer

I finally managed to fix it. The default value for the first dropdown menu was no longer located in the lookup table. Once I removed the default value it worked normally again. Sounds like a Splunk bug.

View solution in original post

0 Karma

smashedpumpkins
Explorer

I finally managed to fix it. The default value for the first dropdown menu was no longer located in the lookup table. Once I removed the default value it worked normally again. Sounds like a Splunk bug.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...