topic Re: Why is selectFirstChoice selecting an incorrect default value for my drop-down list? in Dashboards & Visualizations

Why is selectFirstChoice selecting an incorrect default value for my drop-down list?

ewijkmr — Tue, 29 Sep 2020 09:59:29 GMT

Hi,

I use the following search to dynamically populate a drop-down list. However, the default value selected is not in the resulting top-10 table at all.

      <input type="dropdown" token="jobname" searchWhenChanged="true">
        <label>Select Jobname from Top-10</label>
        <populatingSearch fieldForValue="JOBNAME" fieldForLabel="JOBNAME" earliest="-30d@d" latest="now">
           <![CDATA[sourcetype=sapsr3_tbtc_1* | eval startmoment=strptime(STRTDATE." ".STRTTIME,"%Y%m%d %H%M%S"), eindmoment=strptime(ENDDATE." ".ENDTIME,"%Y%m%d %H%M%S"), runtime=eindmoment-startmoment | stats sum(runtime) by  JOBNAME | sort -sum(runtime) | head 10 | table JOBNAME]]>
        </populatingSearch>        
        <selectFirstChoice>true</selectFirstChoice>
      </input>

Running the search as a normal search shows that the selected value is the one at the top of the table before the head 10 and may be even before the sort sum..... has been applied. My guess is that Splunk is applying the selectFirstChoice to intermediate and not the end result of the search. I.e. ZFIU_REVERSE_SDD_PO is the selected value by selectFirstChoice, but is not part of the top-10 drop-down list.

Any thoughts anyone?

Thanks a bunch!

btw Splunk 6.4.1

Re: Why is selectFirstChoice selecting an incorrect default value for my drop-down list?

sk314 — Wed, 22 Jun 2016 18:31:39 GMT

Did you try sorting by JOBNAME at the end of the populating seach? Just a thought.

Re: Why is selectFirstChoice selecting an incorrect default value for my drop-down list?

somesoni2 — Wed, 22 Jun 2016 19:57:28 GMT

Try using this query for your dropdown

sourcetype=sapsr3_tbtc_1* | eval startmoment=strptime(STRTDATE." ".STRTTIME,"%Y%m%d %H%M%S"), eindmoment=strptime(ENDDATE." ".ENDTIME,"%Y%m%d %H%M%S"), runtime=eindmoment-startmoment | stats sum(runtime) as runtime by  JOBNAME | sort -num(runtime) | head 10 | table JOBNAME

Re: Why is selectFirstChoice selecting an incorrect default value for my drop-down list?

ewijkmr — Thu, 23 Jun 2016 05:19:19 GMT

Thanks both for your answers. However, this morning I was going to try the 'num....' answer and the problem had disappeared!

Don't understand because I worked on this for mulitple hours and did numerous refreshes. I think I didn't do a browser stop/start. May be Splunk has 'some caching remnants' that disappear after restart/reboot.

Thanks anyway for your help!