Trying to extract unique values from a column and display them in the drop-down menu:
index=main source=traffic_information
| search * traffic_location
| fields traffic_location
| dedup traffic_location
| eval traffic_location=split(traffic_location, " ")
| eval field1=mvindex(traffic_location,0)
| stats values(field1)
So far I don't see anything, but this works perfectly fine when I use the same command in Splunk search, but in a dashboard, it doesn't work.
Please help.
Thanks
Your search gives a multivalued field with name 'values(field1)' and you must be selecting 'field1' as fieldForDisplay/fieldForValue. Update the query like this
Updated
index=main source=traffic_information
| search * traffic_location
| stats count by traffic_location
| eval traffic_location=mvindex(split(traffic_location, " "),0)
| stats count by traffic_location
| table traffic_location
Now use traffic_location as fieldForDisplay/fieldForValue
<fieldset submitButton="true" autoRun="true">
<input type="dropdown" token="field1">
<search>
<query>index=main source=traffic_information
| search * traffic_location
| stats count by traffic_location
| eval field1=mvindex(split(traffic_location," "),0)
| dedup field1
| table field1</query>
</search>
<fieldsForLabel>field1</fieldsForLabel>
<fieldsForValue>field1</fieldsForValue>
</input>
</fieldset>
Still shows duplicate values causing conflicts, no data.
try the updated answer