Dashboards & Visualizations

How do I populate a multi select input element with field names only?

BobKimata
Path Finder

Hi guys,
I am running a search based on an SQL query. I would like to extract field names only from the search and populate a multi select input element with all the field names from a table. A user will then select which fields they want to view on a table on another panel. Am trying to achieve a situation where someone can add and remove columns on a table below. Please assist as I am completely stuck.

Thanks

Tags (1)
0 Karma
1 Solution

BobKimata
Path Finder

Hey guys

I managed to find a solution to to it after chewing on it for a while. Its actually quite a simple procedure:

To get the fieldnames for any given search I used this:

<my search> | stats dc() as *

This will give you a single row with one column for every field, where the cell values are the distinct counts. It creates a table on the fly. To flip the table around:

<my search> | stats dc() as *  | transpose

This creates a table with a single column called 'column' that contains a list of all field names.
From this table I populated the multiselect element using this table by setting the required parameters ie the column name. This table is invisible. However to view it, for checking purposes you will need to create a panel for it. Anyway the code worked for me.

<input type="multiselect" token="sourcetype" searchWhenChanged="true">
       <label>Click to Add / Remove Columns</label>
       <populatingSearch fieldForValue="column" fieldForLabel="column"> | dbquery  "select * from performance" | stats dc() as * | transpose</populatingSearch> 
       <fieldForLabel>sourcetype</fieldForLabel>
       <fieldForValue>sourcetype</fieldForValue>
       <prefix>(</prefix>
       <suffix>)</suffix>
       <valuePrefix>sourcetype="</valuePrefix>
       <valueSuffix>"</valueSuffix>
       <delimiter>OR</delimiter>
       <choice value="*">All</choice>
       <default>*</default>
     </input>

Cheers

View solution in original post

BobKimata
Path Finder

Hey guys

I managed to find a solution to to it after chewing on it for a while. Its actually quite a simple procedure:

To get the fieldnames for any given search I used this:

<my search> | stats dc() as *

This will give you a single row with one column for every field, where the cell values are the distinct counts. It creates a table on the fly. To flip the table around:

<my search> | stats dc() as *  | transpose

This creates a table with a single column called 'column' that contains a list of all field names.
From this table I populated the multiselect element using this table by setting the required parameters ie the column name. This table is invisible. However to view it, for checking purposes you will need to create a panel for it. Anyway the code worked for me.

<input type="multiselect" token="sourcetype" searchWhenChanged="true">
       <label>Click to Add / Remove Columns</label>
       <populatingSearch fieldForValue="column" fieldForLabel="column"> | dbquery  "select * from performance" | stats dc() as * | transpose</populatingSearch> 
       <fieldForLabel>sourcetype</fieldForLabel>
       <fieldForValue>sourcetype</fieldForValue>
       <prefix>(</prefix>
       <suffix>)</suffix>
       <valuePrefix>sourcetype="</valuePrefix>
       <valueSuffix>"</valueSuffix>
       <delimiter>OR</delimiter>
       <choice value="*">All</choice>
       <default>*</default>
     </input>

Cheers

BobKimata
Path Finder

I still haven't got a solution yet. Here is the code that I have tried. There is no error but nothing happens as well.

&lt;input type="multiselect" token="sourcetype" searchWhenChanged="true"&gt;
       &lt;label&gt;Click to Add / Remove Columns&lt;/label&gt;
       &lt;search&gt;
         &lt;query&gt; | dbquery AdWordsROI limit=1000 "select * from account_performance" | stats dc() as * &lt;/query&gt;
       &lt;/search&gt;
       &lt;fieldForLabel&gt;sourcetype&lt;/fieldForLabel&gt;
       &lt;fieldForValue&gt;sourcetype&lt;/fieldForValue&gt;
       &lt;prefix&gt;(&lt;/prefix&gt;
       &lt;suffix&gt;)&lt;/suffix&gt;
       &lt;valuePrefix&gt;sourcetype="&lt;/valuePrefix&gt;
       &lt;valueSuffix&gt;"&lt;/valueSuffix&gt;
       &lt;delimiter&gt;OR&lt;/delimiter&gt;
       &lt;choice value="*"&gt;All&lt;/choice&gt;
       &lt;default&gt;*&lt;/default&gt;
     &lt;/input&gt;

Regards

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...