How to get the list of values for dropdown in Splunk Dashboard?

Question

Making a dashboard and want to create a chart. To display the metrics, I must choose cache from the dropdown. The problem is how I can make a list of caches if I have the following log:

Message= [CACHE_NAME=<HERE IS THE NAME OF CACHE> method=GET <SOME_OTHER_STRINGS> found=true]

Desired result:

Answer 1

Get a list of caches by searching for them. Read the log, extract cache names from it, then remove duplicates.

index=foo "CACHE_NAME"
```Extract the cache name from the event```
| rex "CACHE_NAME=(?<cache_name>\S+)"
```Filter out repeated names```
| dedup cache_name
| fields cache_name