Input to splunk is a csv file which has column headers like 'Falcon 15.01.01.03.100', 'Falcon GA 15.01.02.06.1'.. (there are values present under each of these columns in rows). on dashboard, there are 2 dropdowns.
Both the dropdowns should have values of these column header i.e. which has Falcon word in it. Only thing I want is, Value which is selected in 1st dropdown , should not be displayed in 2nd. Means if search returns 3 results, 1st dropdown should have 3 values in it and after selecting the one value from 1st dropdown.. second should have only 2 values in it.
in 1st dropdown, M executing this query: input.csv|fieldsummary *Falcon* | dedup field | table field >> returning me 3 results
What query should I execute in 2nd dropdown for above mentioned scenario?
Thanks in advance!!
↧