Archive

Populate dropdown without clicking a first time on the submit button

New Member

Hi everyone,

I have a dashboard with dropdowns with dynamic options and a submit button to run my searches. But my dropdowns are not populated if I don't click on the submit button a first time. How can I change that ?

Thank you for your answers

0 Karma

Communicator

Hey csimonnet,

Have you tried adding the token from your dropdown to your base search?
I made a quick dashboard using makeresults to illustrate the concept:

<form>
  <label>testdash</label>
  <search id="primary">
    <query>|makeresults count=100
| eval logtype = random()%5
| eval dynamic_field = if(logtype = 0, "dogs", if(logtype = 1, "cats", if(logtype = 2, "lizards", if(logtype = 3, "snakes", if(logtype = 4, "bears", "")))))  
| search $dynamic_dropdown$
</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <fieldset submitButton="true" autoRun="true">
    <input type="dropdown" token="dynamic_dropdown" searchWhenChanged="true">
      <label>Animal Types</label>
      <choice value="dynamic_field=*">all</choice>
      <default>dynamic_field=*</default>
      <initialValue>dynamic_field=*</initialValue>
      <fieldForLabel>dynamic_field</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <search>
        <query>|makeresults count=100
| eval logtype = random()%5
| eval dynamic_field = if(logtype = 0, "dogs", if(logtype = 1, "cats", if(logtype = 2, "lizards", if(logtype = 3, "snakes", if(logtype = 4, "bears", ""))))) 
| dedup dynamic_field 
| sort dynamic_field 
| eval value="dynamic_field=".dynamic_field</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <search base="primary">
          <query>|stats count</query>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</form>

Let me break it down:

<search id="primary"> defines your base search. This search will populate all of your other panels based on this high level search.
Typically this search will look something like:
index=your_index sourcetype=your_sourcetype source=your_source | fields field1 field2 field3

You call on this search by adding <search_base="primary"> to any panel that would would like to build on from the base search.
You can see an example of this in the dashboard above:

<search base="primary">
 <query>|stats count</query>
</search>

Notice how the <query> is very small, that's because it's taking the base search as a starting point and adding onto it.

Lastly, notice in the example dashboard I've added |search $dynamic_dropdown$ to my base search. This is a reference to the token that dynamically populates the dropdown with the values from my search. Without this, your dropdown won't have any effects on your dashboard.

The only other thing I can think of to add is the searchWhenChanged="true" option. If you would like your dashboard to only populate when the submit button is pushed, change this to false.

Hopefully this helps.

0 Karma

SplunkTrust
SplunkTrust

Can you post the <fieldset section of your dashboard? Do remember to format the code using "101010" button on top of the text editor here OR select the code and press Ctrl+K.

0 Karma