Dashboards & Visualizations

How can I select the top value as default in Splunk Dashboard XML dropdown?

Chandras11
Communicator

HI All,

I have a dropdown with Calender weeks on my dashboard as:-

<input type="dropdown" searchWhenChanged="true" token="YEAR_WEEK_t">
        <label>Calender Week</label>
        <search base="First_Base_Search">
               <query>eval Cal_Day=strptime(FIRST_ASSIGNED_DT,"%Y-%m-%d") | eval CAL_Week = strftime(Cal_Day,"%Y-%V")  | table 
                         CAL_Week | dedup CAL_Week | sort - CAL_Week | eval value=CAL_Week 
               </query>
        </search>
        <fieldForLabel>label</fieldForLabel>
        <fieldForValue>value</fieldForValue>
        <default>2018-26</default>
      </input>

Now In default, I want to provide the top value of the CAL_Week after sorting. I would be really grateful if you can show me a way of doing this.

Thanks a lot in advance.

0 Karma
1 Solution

harishalipaka
Motivator

harishalipaka
Motivator

hi @Chandra

<selectFirstChoice>true</selectFirstChoice>

https://answers.splunk.com/answers/120688/how-can-i-set-a-dynamic-default-value-in-a-dropdown-simple...

Thanks
Harish

Chandras11
Communicator

Perfect.. thanks a lot for it. 🙂

0 Karma

493669
Super Champion

Try below :
here default value for dropdown is calculated and it's result is set in token "tkn_cal_week" which can be used in input dropdown.

<form>
   <label>Dropdown default Selection</label>
   <search>
     <query>...| dedup CAL_Week | sort - CAL_Week| table  CAL_Week|head 1</query> //here write your whole query
     <done>
       <set token="tkn_cal_week">$result.CAL_Week$</set>
     </done>
   </search>
<fieldset submitButton="false">
<input type="dropdown" searchWhenChanged="true" token="YEAR_WEEK_t">
         <label>Calender Week</label>
         <search base="First_Base_Search">
                <query>eval Cal_Day=strptime(FIRST_ASSIGNED_DT,"%Y-%m-%d") | eval CAL_Week = strftime(Cal_Day,"%Y-%V")  | table CAL_Week | dedup CAL_Week | sort - CAL_Week | eval value=CAL_Week 
                </query>
         </search>
         <default>$tkn_cal_week$</default>
         <fieldForLabel>label</fieldForLabel>
         <fieldForValue>value</fieldForValue>
        </input>
</fieldset>

Chandras11
Communicator

@493669 Thanks a lot for your answer. It is working with a small modification: $tkn_cal_week$ . I can use the same query to find the values between 2 dates. However, I like the simple argument in the other answer <selectFirstChoice>true</selectFirstChoice>

Thanks a lot for the help. It taught me something new.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...