Is it possible to configure the dropdown input to take the first row returned by the populating Search as its default?
If I configure the dropdown as follows it just has an empty field as its default.
<input type="dropdown" token="source" searchWhenChanged="true">
<label>Select a Sourcetype:</label>
<populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype" earliest="-24h" latest="now">
<![CDATA[index=_internal | stats count by sourcetype]]>
</populatingSearch>
</input>
Thanks,
Chris
As of Splunk 6.0.2, you can now use "selectFirstChoice" to populate the form input with the first returned value.
<input type="dropdown" token="source" searchWhenChanged="true">
<label>Select a Sourcetype:</label>
<populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype" earliest="-24h" latest="now">
<![CDATA[index=_internal | stats count by sourcetype]]>
</populatingSearch>
<selectFirstChoice>true</selectFirstChoice>
</input>
As of Splunk 6.0.2, you can now use "selectFirstChoice" to populate the form input with the first returned value.
<input type="dropdown" token="source" searchWhenChanged="true">
<label>Select a Sourcetype:</label>
<populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype" earliest="-24h" latest="now">
<![CDATA[index=_internal | stats count by sourcetype]]>
</populatingSearch>
<selectFirstChoice>true</selectFirstChoice>
</input>
Thank you very much for this tip.
It doesn't work for me on 8.2.0 in type="multiselect" 😭
Still working in v 7.0.8.
It took me a while to figure out that this does not work for multiselect inputs. Why?
Any update how this has changed in version 6.5 ? I am getting 'not a valid' node as warning.
Also working in v6.2.3
<input type="dropdown" token="field2" searchWhenChanged="true">
<label>Web application</label>
<search>
<query>query</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<fieldForLabel>WebApp</fieldForLabel>
<fieldForValue>WebApp</fieldForValue>
<selectFirstChoice>true</selectFirstChoice>
</input>
Try this on for size:
<param name="search">sourcetype=_internal earliest=-24h |fields host|dedup host
</param>
<param name="label">Select Name</param>
<param name="settingToCreate">host_setting</param>
<param name="searchFieldsToDisplay">
<list>
<param name="value">host</param>
<param name="label">host</param>
</list>
</param>
This should help you get what you want. You can get it to populate the dropdown based on "searchfieldsToDisplay"
This is advanced xml
+1, I already asked this a month back but not resolved yet. http://answers.splunk.com/answers/115727/splunk-6-simple-xml-dropdown-how-to-select-first-value-in-t...
Hi Chris,
If you have got the solution can you please share it with me.Even I'm facing the same issue.