I have a dashboard which comes with an App, build by Splunk. The app is getting some error in populating one of it's dropdown input field. Below is the xml of those input fields." OR " | tstats count where index=*cylance_* AND sourcetype!=*syslog* by Tenant 0 Tenant Tenant All * eventtype=cylance_index sourcetype=device Tenant="$Tenant$" | dedup "Device Name" 0 DeviceName DeviceName [stats count | eval DeviceName=" " | rex mode=sed field=DeviceName "s/’/*/g" | makemv DeviceName delim="," | mvexpand DeviceName | fields DeviceName ]
Could anyone please help me understand how the dropdown field works here and identify the problems behind not populating the field?
Thanks in advance.
↧