How to insert a dynamic dropdown using CSV as a lookup?

[rakeshyv0807]

Hi,

I want to insert a dynamic dropdown for the dashboard I have. Please find below the use case that I have which I want to achieve using splunk and the issue I am facing:

I have a lookup csv file that is loaded into splunk which contains two columns one is 'user friendly app name' (this is the name that I am going to display in the dropdown) and second is 'actual app name' (this is the value associated to each user friendly app name listed in dropdown). When I select the 'user friendly app name' from the dropdown what I need splunk to do it get the 'actual app name' that is associated to the user friendly name and insert that value in the searches that I have on the dashboard.

I could achieve this using the ' Static Options' where I can specify name-value pairs for all the apps. However, I have hundreds of app names to list down and there will be many new apps to add in future.

Right now I have the following XML source for the dropdown:

<input type="dropdown" token="field1" searchWhenChanged="true">
      <label>Application Name</label>
      <default>O365</default>
      <fieldForLabel>App_Name</fieldForLabel>
      <fieldForValue>App_Name</fieldForValue>
      <search>
        <query> |inputlookup Aappmapping_lookup.csv | table  App_Name </query>
      </search>
</input>

From the above search query I can list the values in dropdown but I am unable to get the associated actual app name and insert that in my searches.

Can anyone help me? Thanks in advance.

[poete · Accepted solution]

Hello @rakeshyv0807,

the input configuration will help you there.

In the <fieldForLabel> tag, place the name of the column containing the 'user friendly' name
In the <fieldForValue> tag, place the name of the column containing the app identifier to be used by Splunk.

ANd do not forget to add both column names in the query (right now, you have only one in the table).

[rakeshyv0807]

Thanks, I have changed my dropdown settings like the way you suggested and I am getting ''Duplicate values causing conflict '' error. Is there anything else I need to change?

[jadengoho]

As I understand your question.
1) You have a lookup csv
2) column1 (Display Name) : column2 (actual name)

here is my solution :
you can set the
as column 1 : since it was the label name
as column 2 : since this was the value you want to be input in your searches
hope this works for you

[rakeshyv0807]

@jadengoho Can you please elaborate your solution. You mentioned

you can set the
as column 1 : since it was the label name
as column 2 : since this was the value you want to be input in your searches

What do I need to set column 1 & column 2?

[jadengoho]

I have a lookup csv file that is loaded into splunk which contains two columns one

is 'user friendly app name' (this is the name that I am going to display in the dropdown) : COLUMN ONE
second is 'actual app name' (this is the value associated to each user friendly app name listed dropdown). : COLUMN TWO

When I select the 'user friendly app name' from the dropdown what I need splunk to do it get the 'actual app name' that is associated to the user friendly name and insert that value in the searches that I have on the dashboard.

You have
COLUMN ONE= 'user friendly app name'
COLUMN TWO= 'actual app name'
And what you want to display is the COLUMN ONE but you want to get the value of COLUMN TWO which is associates in the column one

example:

COLUMN_ONE COLUMN_TWO
mypet1 dog
mypet2 cat
mypet3 fish

drilldown will display "mypet1" and it would insert the search "dog"
drilldown will display "mypet2" and it would insert the search "cat" ......
basically you can set the the drilldown.

fieldForLabel COLUMN_ONE fieldForLabel : it says LABEL
fieldForValue COLUMN_TWO fieldForValue : it says VALUE

sorry for that "TAGS (<,>)" was removed by the splunk.

[rakeshyv0807]

@jadengoho Thanks, I have changed my dropdown settings like the way you suggested and I am getting ' > Blockquote Duplicate values causing conflict' > Blockquote error. Is there anything else that I need to change?

[rakeshyv0807]

@jadengoho deduping both fields yielded me results. Thanks for the help.