Dashboards & Visualizations

Why am I getting the dynamic drop-down error "Search is waiting for input"?

matstap
Communicator

I have a dynamic dropdown which takes a token $parent$ as an input for its populating search. I get the $parent$ tag by grabbing the current user's role and using it to get the final parent value from a lookup table. When I run this search outside of the dashboard, I get one value. However, when the dashboard runs, the dynamic dropdown says: "Could not create search. Search is waiting for input."

What are some reasons for this? (Splunk version 6.6.3)

<form >
  <label>Dashboard</label>
 <search>
        <query>| rest /services/authentication/current-context/context 
    | where username !="splunk-system-user" 
    | fields roles 
    | mvexpand roles 
    | join type=inner roles 
        [| inputlookup role_parent.csv ]</query>
        <done>
          <set token="parent">$result.Parent$</set>
        </done>
      </search>
      <fieldset submitButton="true" autoRun="false">
        <input type="multiselect" token="customer">
          <label>Customer</label>
          <delimiter> </delimiter>
          <fieldForLabel>Customer</fieldForLabel>
          <fieldForValue>Customer</fieldForValue>
          <search>
            <query>| inputlookup customers.csv where Parent=$parent$ </query>
          </search>
        </input>
0 Karma
1 Solution

HiroshiSatoh
Champion

I think that you can do it drop down so that the search will be executed.

| inputlookup customers.csv where [※sub search]

※ sub search

| rest /services/authentication/current-context/context 
     | where username !="splunk-system-user" 
     | fields roles 
     | mvexpand roles 
     | join type=inner roles 
         [| inputlookup role_parent.csv ]
     | table Parent

View solution in original post

Vijeta
Influencer

There should be a | before “where” in your inputlookup query for your multi select customer input

0 Karma

HiroshiSatoh
Champion

I think that you can do it drop down so that the search will be executed.

| inputlookup customers.csv where [※sub search]

※ sub search

| rest /services/authentication/current-context/context 
     | where username !="splunk-system-user" 
     | fields roles 
     | mvexpand roles 
     | join type=inner roles 
         [| inputlookup role_parent.csv ]
     | table Parent

matstap
Communicator

This worked for me. Thanks!

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...