Dashboards & Visualizations

Dropdown values are not shown

SrinivasaC
Path Finder

My sample file:

State , District , Total Enrolments

Andaman_and_Nicobar_Islands, Andamans,116866>

Andaman_and_Nicobar_Islands, Port_Blair,2

Andhra_Pradesh, Hyderabad,5004246

Andhra_Pradesh, Ananthapur,92

Arunachal_Pradesh, West_Kameng,143

Arunachal_Pradesh, Lohit,77

I have to get State values in dropdown based on selection, District and enrol values have to show.

My advanced XML form shown below:

<?xml version='1.0' encoding='utf-8'?>


<!-- define master search template, with replacement tokens delimited with $ -->
<searchTemplate>index="states_index" series=$series$ | table "District", "Total_Enrolments"</searchTemplate>

<fieldset>
    <!-- Define a simple dropdown form driven by a search -->
    <input type="dropdown" token="series">
        <label>Select State</label>
        <populatingSearch fieldForValue="series" fieldForLabel="series"><![CDATA[index="states_index"  | dedup State | table State | sort +State]]></populatingSearch>
        <choice value="*">Any</choice>
    </input>
</fieldset>

<row>
    <!-- output the results as a 50 row events table -->
    <table>
        <title>Matching events</title>
        <option name="count">50</option>
    </table>
</row>

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

You've left a few things in the XML set to the values from the example, .

The examples all use a "series" field, whereas here you want it to pull from a field called "State".

You've got series=$series$ in your search, when you want to have State="$State$.

You also have token=series, which is what tells the system you want to use $series$ in your searches to identify the token. You want to change that to token="State"

You then have fieldForValue="series" fieldForLabel="series". This tells the dropdown to look for it's values in a field called series, which of course wont be there. Change those both to be State.

View solution in original post

sideview
SplunkTrust
SplunkTrust

You've left a few things in the XML set to the values from the example, .

The examples all use a "series" field, whereas here you want it to pull from a field called "State".

You've got series=$series$ in your search, when you want to have State="$State$.

You also have token=series, which is what tells the system you want to use $series$ in your searches to identify the token. You want to change that to token="State"

You then have fieldForValue="series" fieldForLabel="series". This tells the dropdown to look for it's values in a field called series, which of course wont be there. Change those both to be State.

SrinivasaC
Path Finder

Thanks sideview

0 Karma

SrinivasaC
Path Finder

I can able to get results when I click on search button. but in dropdown, I'm unable to retrieve States.

0 Karma

SrinivasaC
Path Finder

Im Sorry Im working on forms.
Thanks Martin,
I have followed as example given in the Splunk UI Examples(form_dropdown.xml).

0 Karma

martin_mueller
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...