In a dropdown say there are two values : 1) Apple 2) Banana
Underneath table the data has to come like below , while i select Apple from dropdown (token set already) the data should come like
SID,Apples
1,10
2,20
3,30
while i select Banana from dropdown the data should come like
SID,Apples
4,50
8,20
4,9
Kindly
Try this simple XML
<fieldset>
<input type="dropdown" token="column_tok">
<label>Choose column to display</label>
<choice value="Apples">Apples</choice>
<choice value="Bananas">Bananas</choice>
<default>Apples</default>
<search>
<query>yoursearchhere | table SID $column_tok|s$
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
</input>
</fieldset>
you've opened the same question twice. can you close one? 🙂
https://answers.splunk.com/answers/511492/show-columns-based-on-the-drop-down-values.html
@splunklakshman also there is a correction required in second table example. I think it should be SID, Bananas not Apples.
Can you please confirm whether Apples and Bananas are Field Names or Field Values. If they are values, what is the field name? In any case you can refer to "Define tokens for form inputs" on Splunk documentation: http://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/tokens