topic Re: How to make the dashboard to display latest result by default in Splunk Search

How to make the dashboard to display latest result by default

Azwaliyana — Mon, 10 Jan 2022 08:16:24 GMT

I have made my search query for all time because I have created dropdown for month date and year. But I want the search result to always display the latest result. How can I do that?

I pass the date month and year to the search query. But f or the default, I want the dashboard to always display the latest result

Re: How to make the dashboard to display latest result by default

gcusello — Mon, 10 Jan 2022 08:28:11 GMT

Hi @Azwaliyana,

you can configure you dropdowns to display as default the first result of your search (the first result is the latest!) using something like this example:

<fieldset submitButton="false"> <input type="time" token="Time"> <label>Time</label> <default> <earliest>0</earliest> <latest></latest> </default> </input> <input type="dropdown" token="assessment"> <label>Assessments</label> <fieldForLabel>_time</fieldForLabel> <fieldForValue>_time</fieldForValue> <selectFirstChoice>true</selectFirstChoice> <search> <query> eventtype=tenable_assessment | dedup _time | sort -_time | table _time </query> <earliest>$Time.earliest$</earliest> <latest>$Time.latest$</latest> </search> <prefix>AssessmentDate="</prefix> <suffix>"</suffix> </input> </fieldset>

In this example, using the selectFirstChoice=True option, your dropdown displays as default the first (latest) result of the search used in the input.

Ciao.

Giuseppe

Re: How to make the dashboard to display latest result by default

Azwaliyana — Tue, 11 Jan 2022 06:58:06 GMT

@gcusello Thank you for the solution