Splunk Search

Populating search not working

theouhuios
Motivator

Hello

I am trying to autopopulate the below input type and its not giving any data in the dropbox. Can anyone please tell me where am I doing a mistake?



*
<![CDATA[earliest=-31d@d sourcetype="incident"|stats count by record.groupArea]]>

alt text

<?xml version='1.0' encoding='utf-8'?>






Reactionary
Cautionary

<input type="dropdown" token="Dept">
  <label>Department: </label>
  <default>*</default>
  <choice value="*">All</choice>
  <choice value="Systems">Systems</choice>
  <choice value="Agency">Agency</choice>
</input>
<input type="dropdown" token="Area">
  <label>Area: </label>
  <default>*</default>
   <populatingSearch fieldforvalue="Area" fieldforlabel="Area"> <![CDATA[earliest=-31d@d sourcetype="incident"|rename record.groupArea as Area |stats count by Area]]> </populatingSearch>
</input>

<input type="text" token="WG">
  <label>WorkGroup: </label>
  <default>*</default>
</input>
<input type="text" token="CI">
  <label>CI: </label>
  <default>*</default>
</input>


Tags (1)
0 Karma

srowe
Explorer

also, autorun should be "autoRun" camel case. It took me awhile to realize that!

0 Karma

rroberts
Splunk Employee
Splunk Employee

Should be upper case S in populatingSearch

0 Karma

rroberts
Splunk Employee
Splunk Employee

Did you have any luck?

0 Karma

rroberts
Splunk Employee
Splunk Employee

Check case sensitivity:

fieldForValue= fieldForLabel=

0 Karma

theouhuios
Motivator

Updated the initial post. I did try to change the name and try it but it doesn't work.

0 Karma

rroberts
Splunk Employee
Splunk Employee

Trying to recreate. Can you add the entire form XML please?

0 Karma

theouhuios
Motivator

Any help??

0 Karma

rroberts
Splunk Employee
Splunk Employee

I think it might be a problem with the . in the field name.

0 Karma

theouhuios
Motivator

That removes the error, but there is no data being populated in the dropdown. Updating the first post with the image of the data

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...