How can I create a wildcard for a dropdown menu?

[usernamejpblais]

HI Splunker's!

In a dashboard I have a dropdown menu populated from a inputlookup CSV file. I have more then 1500 entries in that table. I want to be able to select a particular choice from the dropdown but also to be able to put a wildcard to get multiple choices from that table.

Example:
Let say that my table contains "transaction code" :
ZGCM01C
ZGCM01L
ZGCM01M
ZGCM02C
ZGCM02L
ZGCM03C ...etc

I want to be able to choose 1 single instance like ZGCM01C or be able to put ZGCM* to get all the choices listed in the example above.

Here I have my search string that given me all the result I have in the table.:
|inputlookup trprod_lookup
| dedup TRPROD
| sort TRPROD
| table TRPROD

To use a wildcard I tried this in a independent search and it work's fine:
|inputlookup trprod_lookup
| dedup TRPROD| sort TRPROD
| table TRPROD | search TRPROD="ZGMC*"

But if I put this in my search from the dropdown menu it does'nt produce any result.
|inputlookup trprod_lookup
| dedup TRPROD| sort TRPROD
| table TRPROD | search TRPROD="$sel_TX$"

Any suggestion?

Thanks!

[rrovers]

Hi usernamejpblais

I don't know if it is exactly what you are looking for, because it's not really flexible, but maybe it's an option to use "choice value" in your picklist:

<input type="dropdown" token="trans_cd" searchWhenChanged="true">
<label>Select a transaction code:</label>
<choice value="ZGMC*">ZGMC*</choice>

[jnudell_2 · Accepted solution]

Hi @usernamejpblais ,
You cannot generate a wildcard value for a dropdown list, or a multichoice box, or a radio button (at least not with the standard Splunk simple XML format, advanced javascript/html is probably beyond the scope of your question). You can have a text box input that you can take the results from and put a wildcard after it.

You CAN create an static entry that includes a wildcard value in the list of choices.

For your use case, however, I would recommend NOT using a dropdown box because your list of options is very large. Dropdown lists make more sense for lists that are somewhere in the range of a few choices to maybe a couple of dozen. Anything more than that becomes a hassle to search and use.

There are other options. You could split the choices into two options:
First X characters (maybe 3 or 4 in your case) which filters to only items starting with those first 3 or 4 characters, and then a second dropdown that will provide results for all the values that start with the first 4 characters provided in the first box.

I hope this helps.

[kmorris_splunk]

I think you may need to use the Prefix and Suffix to add the quotes around the selected value. The way it is now, it is probably treating $sel_TX$ as a string. In the config for the dropdown, add a " as the prefix and a " as the suffix, then remove from your search around the $sel_TX$.

[kmaron]

can you share the XML that is the definition of your dropdown?

[Vijeta]

@usernamejpblais your dropdown has the value ZGMC* ? Try search TRPROD=$sel_TX$

[amitm05]

@usernamejpblais

Where is this token $sel_TX$ getting the value from ?