topic Re: Dropdown not populated after version 6 upgrade in Installation

Dropdown not populated after version 6 upgrade

polymorphic — Wed, 23 Oct 2013 09:13:09 GMT

We have some dropdowns which does not work after upgrade to Version 6.

The dropdowns is populated by a saved search with report acceleration.

The problem is that the dropdown doesn't get fully populated with the search result. Only the first returned row and the "All" is shown.
Also the "All" value is not selected as it should, but instead the first returned row is selected as default.

The same problem exists when i try to populate the dropdown with a normal search:

<populatingSearch fieldfForValue="customer" fieldForLabel="customer"><![CDATA[|savedsearch ListToolCustomer]]></populatingSearch>

The search is working with no problems, when i run it "manually":

|savedsearch ListToolCustomer

This is the simpleXML:

<?xml version='1.0' encoding='utf-8'?>
<form>

  <label>Splunk "List" Tool</label>
  <searchTemplate>
    `SplunkListTool3(customer=$customer$, customer_type=$customer_type$)`
  </searchTemplate>

  <fieldset autoRun="true">    

    <input type="dropdown" token="customer">
      <label>Customer</label>
      <choice value="*">All</choice>
      <populatingSavedSearch fieldfForValue="customer" fieldForLabel="customer">ListToolCustomer</populatingSavedSearch>
    </input>

    <input type="dropdown" token="customer_type">
      <label>Customer Type</label>
      <choice value="*">All</choice>
      <populatingSavedSearch fieldfForValue="customer_type" fieldForLabel="customer_type">ListToolCustomerType</populatingSavedSearch>
    </input>

    <input type="time" searchWhenChanged="true">
      <default>Last 4 hours</default>      
    </input>

  </fieldset>
  <row>
    <table>
      <title>Splunk List Report</title>
      <option name="showPager">true</option>
      <option name="count">500</option>
    </table>
  </row>
</form>

Any ideas on my problem?

Re: Dropdown not populated after version 6 upgrade

afishkin_splunk — Thu, 24 Oct 2013 16:17:04 GMT

please use autoRun instead autorun

Re: Dropdown not populated after version 6 upgrade

polymorphic — Fri, 25 Oct 2013 06:13:45 GMT

That didnt change anything.

Re: Dropdown not populated after version 6 upgrade

afishkin_splunk — Fri, 25 Oct 2013 16:41:35 GMT

I'd like to try if populatingSavedSearch (ListToolCustomer and ListToolCustomerType) are working outside of form
Using autoRun instead of autorun should give indication at least for "All"
One more fix is searchwhenchanged should be replaced with searchWhenChanged to refresh the Panel after changing time

Re: Dropdown not populated after version 6 upgrade

polymorphic — Mon, 28 Oct 2013 07:07:19 GMT

Yes, as described, the searches works just fine when i run the saved search in the searchbar.

autoRun instead of autorun does not set "All" as selected.
searchWhenChanged instead of searchwhenchanged does not refresh the panel after changing time.

I have tried to create a similar dropdown on another Splunk installation, but the problem is the same.

Also im confident, that you easily can replicate this issue on another Splunk installation.

Re: Dropdown not populated after version 6 upgrade

afishkin_splunk — Mon, 28 Sep 2020 15:06:35 GMT

please replace "fieldfForValue" with "fieldForValue"
Dropdowns have
fieldfForValue="customer_type" fieldForLabel="customer_type" (and customer)
they will get data of saved searches if there is specified field in search like
| eval customer_type=sourcetype

Re: Dropdown not populated after version 6 upgrade

polymorphic — Tue, 29 Oct 2013 06:50:02 GMT

Argh.
I have been reading the XML over and over for those kind of mistakes...

Pretty weird tho, that it worked in version 5.

Thank you very much for your assistance.