Getting Data In

How to populate a dropdown from records inside a single JSON event?

a238574
Path Finder

I have a single json event that contains a list of accounts with a Business Unit Tag. I want to create a dropdown that contains a list of Business Units so the user can see only the accounts in their Business Unit. the single record looks like this in Json format

{   [-] 
       accounts: [  [-] 
         {  [-]
             BU: BU1        
         Id: Acct1      
         Name: Name1
             } 
            { [-]
             BU: BU1        
         Id: Acct2      
         Name: Name2
             } 
             {  [-]
             BU: BU2        
         Id: Acct3      
         Name: Name3
             }

I can get list of unique Business Unit names using this query

index=x | spath output=BUnit path=accounts{}.BU | stats values(BUnit)

But when I try and use the search to populate the dropdown I get a single option that is a comma seperated list i.e. "BU1,BU2"

   <input type="dropdown" token="BUName">
  <label>Business Unit</label>
  <fieldForLabel>BUnit</fieldForLabel>
  <fieldForValue>BUnit</fieldForValue>
  <search>
    <query>index=aws sourcetype="acctlistinfo"| spath output=BUnit path=accounts{}.BU | stats values(BUnit) | stats list(values(BUnit)) as BUnit</query>
    <earliest>-4h@m</earliest>
    <latest>now</latest>
  </search>
</input>
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Your current stats command generates a single row with a multivalued field for BU, the everything in dropdown comes in single option. Try something for your dropdown search

index=x | spath output=BUnit path=accounts{}.BU | stats count by BUnit | table BUnit

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Your current stats command generates a single row with a multivalued field for BU, the everything in dropdown comes in single option. Try something for your dropdown search

index=x | spath output=BUnit path=accounts{}.BU | stats count by BUnit | table BUnit
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...