Hey folks, I hope you can help me out as I'm stumped. I have a cascading dropdown menu. The 2nd dropdown menu relies on the first to obtain its variables. When I load the page, the first dropdown menu populates with no issue. When I make a selection with the first dropdown menu the second dropdown menu does not populate. If I select a different item in the first dropdown menu, after having already made my first selection, the second dropdown menu populates just fine. It does not matter which item I select in the first drop down menu, the issue always occurs.
<input type="dropdown" token="UCID">
<label>Select Item</label>
<default>Default Item 1</default>
<populatingSearch fieldForValue="UCID" fieldForLabel="UCID">
<![CDATA[|inputlookup item_1_lookup | fields "Use Case" | rename "Use Case" AS "UCID" | uniq "UCID" | sort "UCID"]]>
</populatingSearch>
</input>
<input type="dropdown" token="FNAME">
<label>Select Sub-item</label>
<default>*</default>
<populatingSearch fieldForValue="FNAME" fieldForLabel="FNAME">
<![CDATA[|inputlookup item_1_lookup | search "Use Case"="$UCID$" | fields "Field Name" | rename "Field Name" AS "FNAME" | sort "FNAME"]]>
</populatingSearch>
</input>
I finally managed to fix it. The default value for the first dropdown menu was no longer located in the lookup table. Once I removed the default value it worked normally again. Sounds like a Splunk bug.
I finally managed to fix it. The default value for the first dropdown menu was no longer located in the lookup table. Once I removed the default value it worked normally again. Sounds like a Splunk bug.