Dashboards & Visualizations

How can I set a dynamic default value in a dropdown (Simple XML)

Motivator

Is it possible to configure the dropdown input to take the first row returned by the populating Search as its default?
If I configure the dropdown as follows it just has an empty field as its default.

<input type="dropdown" token="source" searchWhenChanged="true">
  <label>Select a Sourcetype:</label>
  <populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype" earliest="-24h" latest="now">
    <![CDATA[index=_internal | stats count by sourcetype]]>
  </populatingSearch>
</input>

Thanks,
Chris

1 Solution

Splunk Employee
Splunk Employee

As of Splunk 6.0.2, you can now use "selectFirstChoice" to populate the form input with the first returned value.

  <input type="dropdown" token="source" searchWhenChanged="true">
     <label>Select a Sourcetype:</label>
     <populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype" earliest="-24h" latest="now">
        <![CDATA[index=_internal | stats count by sourcetype]]>
     </populatingSearch>
     <selectFirstChoice>true</selectFirstChoice>
  </input>

View solution in original post

Splunk Employee
Splunk Employee

As of Splunk 6.0.2, you can now use "selectFirstChoice" to populate the form input with the first returned value.

  <input type="dropdown" token="source" searchWhenChanged="true">
     <label>Select a Sourcetype:</label>
     <populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype" earliest="-24h" latest="now">
        <![CDATA[index=_internal | stats count by sourcetype]]>
     </populatingSearch>
     <selectFirstChoice>true</selectFirstChoice>
  </input>

View solution in original post

Contributor

Still working in v 7.0.8.

Builder

It took me a while to figure out that this does not work for multiselect inputs. Why?

Any update how this has changed in version 6.5 ? I am getting 'not a valid' node as warning.

0 Karma

Path Finder

Also working in v6.2.3

 <input type="dropdown" token="field2" searchWhenChanged="true">
      <label>Web application</label>
      <search>
        <query>query</query>
        <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
      </search>
      <fieldForLabel>WebApp</fieldForLabel>
      <fieldForValue>WebApp</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
    </input>

Contributor

Try this on for size:

<param name="search">sourcetype=_internal earliest=-24h |fields host|dedup host
</param>
<param name="label">Select Name</param>
<param name="settingToCreate">host_setting</param>
<param name="searchFieldsToDisplay">
  <list>
    <param name="value">host</param>
    <param name="label">host</param>
  </list>
</param>

This should help you get what you want. You can get it to populate the dropdown based on "searchfieldsToDisplay"

0 Karma

Splunk Employee
Splunk Employee

This is advanced xml

0 Karma

SplunkTrust
SplunkTrust
0 Karma

Hi Chris,
If you have got the solution can you please share it with me.Even I'm facing the same issue.

0 Karma