I have a dynamic dropdown which takes a token $parent$ as an input for its populating search. I get the $parent$ tag by grabbing the current user's role and using it to get the final parent value from a lookup table. When I run this search outside of the dashboard, I get one value. However, when the dashboard runs, the dynamic dropdown says: "Could not create search. Search is waiting for input."
What are some reasons for this? (Splunk version 6.6.3)
<form >
<label>Dashboard</label>
<search>
<query>| rest /services/authentication/current-context/context
| where username !="splunk-system-user"
| fields roles
| mvexpand roles
| join type=inner roles
[| inputlookup role_parent.csv ]</query>
<done>
<set token="parent">$result.Parent$</set>
</done>
</search>
<fieldset submitButton="true" autoRun="false">
<input type="multiselect" token="customer">
<label>Customer</label>
<delimiter> </delimiter>
<fieldForLabel>Customer</fieldForLabel>
<fieldForValue>Customer</fieldForValue>
<search>
<query>| inputlookup customers.csv where Parent=$parent$ </query>
</search>
</input>
I think that you can do it drop down so that the search will be executed.
| inputlookup customers.csv where [※sub search]
※ sub search
| rest /services/authentication/current-context/context
| where username !="splunk-system-user"
| fields roles
| mvexpand roles
| join type=inner roles
[| inputlookup role_parent.csv ]
| table Parent
There should be a | before “where” in your inputlookup query for your multi select customer input
I think that you can do it drop down so that the search will be executed.
| inputlookup customers.csv where [※sub search]
※ sub search
| rest /services/authentication/current-context/context
| where username !="splunk-system-user"
| fields roles
| mvexpand roles
| join type=inner roles
[| inputlookup role_parent.csv ]
| table Parent
This worked for me. Thanks!