Splunk Enterprise

help on a dropdown list from an lookup

jip31
Motivator

Hi

I retrieve the fields of a dropdown list from an CSV file

It works but the probleme I have is that randomnly I have the message "filling on going" which last and as a consequence I am unable to update the dashboards panels because each panels are referenced to this dropdown list

there is 1300 lines in my csv file

What is the problem please?

 <input type="dropdown" token="site" searchWhenChanged="true">
      <label>Site</label>
      <fieldForLabel>site</fieldForLabel>
      <fieldForValue>site</fieldForValue>
      <search>
        <query>| inputlookup site.csv</query>
      </search>
      <choice value="*">*</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>

  

Labels (1)
Tags (1)
0 Karma
1 Solution

Gr0und_Z3r0
Contributor

Try using stats in your dropdown to show the dropdown value...

Something like this... 

| inputlookup site.csv
| stats dc(site) by site


Splunk's dropdown can only show up to 1000 rows rest are shown as you type in... 

View solution in original post

0 Karma

Gr0und_Z3r0
Contributor

Try using stats in your dropdown to show the dropdown value...

Something like this... 

| inputlookup site.csv
| stats dc(site) by site


Splunk's dropdown can only show up to 1000 rows rest are shown as you type in... 

0 Karma

Gr0und_Z3r0
Contributor

Its not a good idea to have such a long dropdown. It will not be efficient at all. Maybe if you could subdivide the dropdowns into multiple sites. Cascading dropdowns... where the second site dropdown is derived based on the 1st dropdown
Region -> Site
Or Use text input field to match and drive your dashboard search panels.

A similar question was asked earlier in the forum.

https://community.splunk.com/t5/Dashboards-Visualizations/What-is-the-maximum-limitation-of-drop-dow... 

0 Karma

jip31
Motivator

I understand but this example can't be applicable for me

So is it better to continue o use a csv lookup in the dropdown list or to use an inline search directly?

I am just speaking about performances

Thanks

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...