Dashboards & Visualizations

What is the maximum limitation of drop-down values ?

nibedan2020
New Member

I am trying to set up a dropdown on over 90000 unique values. But all the values are not coming in the dropdown. why this is happening? Are there any limitations?

0 Karma

woodcock
Esteemed Legend

Even if it was working, it would be functionally useless. When we have to do this kind of thing, we institute a pre-filter like this (here we are searching for server names) which cuts down the actual list to a manageable level.

<input type="text" token="server_name_partial" searchWhenChanged="false">
  <label>RegEx filter for Server Dropdown --></label>
  <default>.</default>
</input>
<input type="dropdown" token="server_name" searchWhenChanged="false">
  <label>(<-- filtered) Server Selector:</label>
  <default>*</default>
  <choice value="*">All</choice>
  <fieldForLabel>server_name</fieldForLabel>
  <fieldForValue>server_name</fieldForValue>
  <search>
    <query>| inputcsv servernamelist.csv | regex server_name="(?i)$server_name_partial$" | table server_name</query>
    <earliest>-1s</earliest>
    <latest>now</latest>
  </search>
</input>
0 Karma

anmolpatel
Builder

Unsure if there is a max limit to the dropdown.
There is one way to test this out.

1) Write the current list of unique values to a lookup table

index=test
| stats count by Unique_values
| outputlookup Unique_values.csv

2) now create the dropdown

| inputlookup Unique_values.csv
| fields Unique_values

This overcomes any issues that could be happening due to slow search output or any other performance hit. If it populates all values, job done, otherwise there might be a newly discovered feature (limit on dropdown values).

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...