Splunk Search

How to add values dynamically from a search to a drop-down input?

guillecasco
Path Finder

Hey,

I have something like this for a drop-down in a Splunk dashboard:

<input type="dropdown" token="trouID" searchWhenChanged="true">
  <label>AssetID</label>
  <label>AssetID</label>
  <choice value="">All</choice>
  <choice value="1243bd9c9206">Aeroplane</choice>
  <choice value="4b10fbec">tractor</choice>
  <choice value="6cf817f5d">car</choice>
  <choice value="14a4f0">skate App</choice>

and every time a new value appears from a search, I have to manually add it. Is there a way in which new values can be added dynamically to the drop-down?

example of search:

 index=host....... |stats values (trouID)

thanks

Tags (3)
0 Karma

somesoni2
Revered Legend

Try this

 <input type="dropdown" token="trouID" searchWhenChanged="true">
   <label>AssetID</label>
  <choice value="*">All</choice>
      <search>
        <query>
          index=host....... |stats count by trouID | table trouID
        </query>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>trouID</fieldForLabel>
      <fieldForValue>trouID</fieldForValue>     
      <default>*</default>
    </input>
0 Karma

sundareshr
Legend

You can use a search to define the choices for a dropdown. See here for the how

http://docs.splunk.com/Documentation/Splunk/6.0/Viz/Buildandeditforms#Static_and_dynamic_inputs_to_f...

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...