I am using a dynamic dropdown, with the below search
<basesearch> |dedup REGN|table REGN
When i run this search i see the below results
But, when I use the above search in the dropdown, I see populating displayed for a while and then when I click the Dropdown, i see the below and the circle spins forever. What am I doing wrong here? Below is my Dropdown code
<input type="dropdown" token="Region" searchWhenChanged="true">
<search>
<query><basesearch>| dedup REGN | table REGN</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<fieldForLabel>Region</fieldForLabel>
<fieldForValue>Region</fieldForValue>
</input>
Also, can i use the Shared TimePicker for the dynamic dropdown query?
I saw this same error fairly recently on a version of Splunk 6.3. I used the following search for my dropdown:
| inputlookup mycsv.csv | table MyField
I eventually found that the reason for the ever spinning circle was that I had some empty field values in my csv. I tried using fillnull in my search, so that there were no null fields, but I still encountered the same issue. Finally I manually edited the csv and replaced the blank field values with zeros and it worked.
Any chance you have any blank field values in the data that you are searching?
The way I found this was because there was a javascript error when I clicked on the dropdown. You probably have the same - if the above is not relevant to you, perhaps you could let us know the javascript error, assuming there is one? (Found by opening developer tools in your browser)
Note: My error was fixed as of 6.5, didn't test on 6.4.
Thanks @lquinn - the issue was the values for below fields. I changed it to REGN, the table column name from the query and it worked.
<fieldForLabel>Region</fieldForLabel>
<fieldForValue>Region</fieldForValue>
Yep, you're right, those two fields definitely should be matching! You should post that as the answer and accept since that solves your issue.