topic Re: show overall data in table if no option is selected in dropdown in Splunk Search

show overall data in table if no option is selected in dropdown

vikas_gopal — Fri, 14 Feb 2014 15:46:06 GMT

Please suggest how to sow all records in the table if no option or record has been selected in the dropdown. Here is my code , rt now, table is blank initially and it shows data only when I select some value from dropdown.

Re: show overall data in table if no option is selected in dropdown

jbrodsky_splunk — Fri, 14 Feb 2014 17:41:42 GMT

You need to add a default value as a wildcard. There's a good example of this in the Splunk 6 Dashboard Examples app which is freely downloadable. Basically, after your "label" tags and before your "populating search" tags you will add this:

<default>*</default>
<choice value="*">All</choice>

You may also consider modifying your fieldset and input tags like this:

<fieldset autoRun="true" submitButton="false">
<input type="dropdown" token="bookcode" searchWhenChanged="true">

Hope that helps.

Re: show overall data in table if no option is selected in dropdown

vikas_gopal — Mon, 28 Sep 2020 15:53:45 GMT

Thanks jbrodsky_splunk for the quick responce

Actually I have already applied this thing and I took help from splunk example only but still table is blank with wild card or with "All" choice in dropdown .What I understood out of this is since table is base on a query which is further dependent on dropdown option ,now "All" is nowhere in the data which is a kind of mismatch that is why table is blank or showing no record.....as you suggested I have changed my code to

Select series

<choice value="">All

<![CDATA[| dbquery "Finance Database" "select distinct book_type_code "bookcode" from fa_deprn_periods" ]]>

  </input>
</fieldset>

Matching events
| dbquery "Finance Database" "select * from fa_deprn_periods where BOOK_TYPE_CODE='$bookcode$' "

</table>
</row>

Still no record in the table 😞

Re: show overall data in table if no option is selected in dropdown

jbrodsky_splunk — Mon, 28 Sep 2020 15:53:56 GMT

The choice value should not be "All" - that's just what the dropdown should display. All should be substituted with "*" in the actual splunk search query. So the question is, will this query return anything:

| dbquery "Finance Database" "select * from fa_deprn_periods where BOOK_TYPE_CODE='*' "

...when input into a Splunk search outside of your populating search? If no, then there is your answer.

You might try instead where BOOK_TYPE_CODE='%' or where BOOK_TYPE_CODE LIKE '%' and then change the "choice value" field to All if it works.

Re: show overall data in table if no option is selected in dropdown

vikas_gopal — Wed, 19 Feb 2014 10:20:59 GMT

You are Awsome jbrodsky_splunk
I tried it with % and it works....yipieeeee

Re: show overall data in table if no option is selected in dropdown

jbrodsky_splunk — Wed, 19 Feb 2014 19:19:00 GMT

Great to hear that it worked out!