I currently have a dropdown that is working properly but I want to add an All selection and make it default. The problem I am running into is either it will select all items in the inputlookup or it will return nothing.
XML for working dropdown:
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="ProjectName" searchWhenChanged="true">
<label>Project Name</label>
<fieldForLabel>PROJ_NAME</fieldForLabel>
<fieldForValue>PROJ_NAME</fieldForValue>
<search>
<query>| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
</input>
</fieldset>
This will create a dropdown like:
Project ABC
Project DEF
Project XYZ
And yes there are spaces in the output.
I have tried something like this:
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="ProjectName" searchWhenChanged="true">
<label>Project Name</label>
<fieldForLabel>PROJ_NAME</fieldForLabel>
<fieldForValue>PROJ_NAME</fieldForValue>
<search>
<query>| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<choice value="*">All Projects</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>
</fieldset>
But this returns ALL ProjectCodes and is not limiting it to 99*
I also tried the following:
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="ProjectName" searchWhenChanged="true">
<label>Project Name</label>
<fieldForLabel>PROJ_NAME</fieldForLabel>
<fieldForValue>PROJ_NAME</fieldForValue>
<search>
<query>| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<choice value="all_projects">All Projects</choice>
<change>
<condition value="all_projects">
<set token="queryFilter">[| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME]</set>
</condition>
<condition>
<set token="queryFilter">PROJ_NAME="$value$"</set>
</condition>
</change>
</input>
</fieldset>
This just returns nothing.
Any help would be greatly appreciated.
Hi @sb01splunk,
I tried using your second code, but the value of token "ProjectName" as all_projects
It does not take the query results in the dropdown.
Can you please suggest how to resolve it?
Thank you
Taruchit
| inputlookup assets.csv | return ProjectCode | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode
Try this and also you can also try without the table part in your query. You don't have to use the table in a dropdown search.
Hope this helps. Thanks for the question.
After looking into network logs in browser I figured it out like sort command is truncating the results to 10000 rows. May be I should avoid it as dropdown already having the filter option (autocomplete).
messages: [{type: "INFO", text: "The sort command is truncating output to 10000 rows"}]
preview: false
results: [{env_name: "mlcd1", count: "1"}, {env_name: "mlcd2", count: "1"}, {env_name: "mlct1", count: "1"},…]
0: {env_name: "mlcd1", count: "1"}
1: {env_name: "mlcd2", count: "1"}
2: {env_name: "mlct1", count: "1"}
3: {env_name: "mlct2", count: "1"}
4: {env_name: "np1", count: "1"}