Splunk Search

Populating search not working

theouhuios
Motivator

Hello

I am trying to autopopulate the below input type and its not giving any data in the dropbox. Can anyone please tell me where am I doing a mistake?



*
<![CDATA[earliest=-31d@d sourcetype="incident"|stats count by record.groupArea]]>

alt text

<?xml version='1.0' encoding='utf-8'?>






Reactionary
Cautionary

<input type="dropdown" token="Dept">
  <label>Department: </label>
  <default>*</default>
  <choice value="*">All</choice>
  <choice value="Systems">Systems</choice>
  <choice value="Agency">Agency</choice>
</input>
<input type="dropdown" token="Area">
  <label>Area: </label>
  <default>*</default>
   <populatingSearch fieldforvalue="Area" fieldforlabel="Area"> <![CDATA[earliest=-31d@d sourcetype="incident"|rename record.groupArea as Area |stats count by Area]]> </populatingSearch>
</input>

<input type="text" token="WG">
  <label>WorkGroup: </label>
  <default>*</default>
</input>
<input type="text" token="CI">
  <label>CI: </label>
  <default>*</default>
</input>


Tags (1)
0 Karma

srowe
Explorer

also, autorun should be "autoRun" camel case. It took me awhile to realize that!

0 Karma

rroberts
Splunk Employee
Splunk Employee

Should be upper case S in populatingSearch

0 Karma

rroberts
Splunk Employee
Splunk Employee

Did you have any luck?

0 Karma

rroberts
Splunk Employee
Splunk Employee

Check case sensitivity:

fieldForValue= fieldForLabel=

0 Karma

theouhuios
Motivator

Updated the initial post. I did try to change the name and try it but it doesn't work.

0 Karma

rroberts
Splunk Employee
Splunk Employee

Trying to recreate. Can you add the entire form XML please?

0 Karma

theouhuios
Motivator

Any help??

0 Karma

rroberts
Splunk Employee
Splunk Employee

I think it might be a problem with the . in the field name.

0 Karma

theouhuios
Motivator

That removes the error, but there is no data being populated in the dropdown. Updating the first post with the image of the data

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...