topic Splunk 6 Simple xml dropdown, how to select first value in the list in Dashboards & Visualizations

Splunk 6 Simple xml dropdown, how to select first value in the list

somesoni2 — Wed, 18 Dec 2013 22:14:06 GMT

Hi All,

I have dashboard created in Splunk 6, simple xml. It has a dropdown input which is getting populated from a lookup file. I would like to select the first value in the dropdown, when the dashboard is loaded.

Any idea how to do the same? I am breaking my head for 3 hrs but got nothing.

Thanks in advance.

Re: Splunk 6 Simple xml dropdown, how to select first value in the list

jtrujillo — Thu, 13 Feb 2014 19:41:54 GMT

Same issue, here is the code that I am using, and its not auto populating.

<input type="dropdown" token="host">
  <label>Host</label>
  <default>All Sites</default>
  <choice value="*">All Sites</choice>

  <populatingSearch fieldForValue="host" fieldForLabel="host">
    <![CDATA[| inputlookup current_connections_dropdown.csv
      | fields host
      | dedup host
      | sort host]]>
  </populatingSearch>
</input>

Re: Splunk 6 Simple xml dropdown, how to select first value in the list

the_wolverine — Mon, 17 Mar 2014 23:39:26 GMT

Unfortunately it seems to work in version 5.0.3. It takes the first value of my input lookup file which is NOT what I want. I want it to just not run and allow the user to select to search. Guess I need to upgrade to 6 and you need to downgrade to 5 🙂

Re: Splunk 6 Simple xml dropdown, how to select first value in the list

nfilippi_splunk — Tue, 18 Mar 2014 00:07:52 GMT

As of 6.0.2, you have the ability to configure the input to populate with the first selection on page load. It should look something like this:

 <input type="dropdown" token="sourcetype" searchWhenChanged="true">
      <label>Sourcetype</label>
      <selectFirstChoice>true</selectFirstChoice>
      <prefix>sourcetype="</prefix>
      <suffix>"</suffix>
      <choice value="*">ANY</choice>
      <populatingSearch fieldForLabel="sourcetype" fieldForValue="sourcetype" earliest="-24h" latest="now">index=_internal
| stats count by sourcetype
| sort asc sourcetype</populatingSearch>
</input>

Re: Splunk 6 Simple xml dropdown, how to select first value in the list

somesoni2 — Tue, 01 Apr 2014 20:09:40 GMT

Thanks its working on 6.0.2 Splunk. Just had to remove the "*, ANY" part.

Re: Splunk 6 Simple xml dropdown, how to select first value in the list

somesoni2 — Tue, 01 Apr 2014 20:10:44 GMT

Upgrade to 6.0.2 Maintenance version and then use options mentioned in the accepted answer. The property is not present in documentation though.