How can I set a dynamic default value in a dropdown (Simple XML)

[chris]

Is it possible to configure the dropdown input to take the first row returned by the populating Search as its default?
If I configure the dropdown as follows it just has an empty field as its default.

<input type="dropdown" token="source" searchWhenChanged="true">
  <label>Select a Sourcetype:</label>
  <populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype" earliest="-24h" latest="now">
    <![CDATA[index=_internal | stats count by sourcetype]]>
  </populatingSearch>
</input>

Thanks,
Chris

[nfilippi_splunk · Accepted solution]

As of Splunk 6.0.2, you can now use "selectFirstChoice" to populate the form input with the first returned value.

  <input type="dropdown" token="source" searchWhenChanged="true">
     <label>Select a Sourcetype:</label>
     <populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype" earliest="-24h" latest="now">
        <![CDATA[index=_internal | stats count by sourcetype]]>
     </populatingSearch>
     <selectFirstChoice>true</selectFirstChoice>
  </input>

[mclane1]

Thank you very much for this tip.

It doesn't work for me on 8.2.0 in type="multiselect" 😭

[grittonc]

Still working in v 7.0.8.

[helge]

It took me a while to figure out that this does not work for multiselect inputs. Why?

[nishantmishra21]

Any update how this has changed in version 6.5 ? I am getting 'not a valid' node as warning.

[josefa]

Also working in v6.2.3

 <input type="dropdown" token="field2" searchWhenChanged="true">
      <label>Web application</label>
      <search>
        <query>query</query>
        <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
      </search>
      <fieldForLabel>WebApp</fieldForLabel>
      <fieldForValue>WebApp</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
    </input>

[Lazarix]

Try this on for size:

<param name="search">sourcetype=_internal earliest=-24h |fields host|dedup host
</param>
<param name="label">Select Name</param>
<param name="settingToCreate">host_setting</param>
<param name="searchFieldsToDisplay">
  <list>
    <param name="value">host</param>
    <param name="label">host</param>
  </list>
</param>

This should help you get what you want. You can get it to populate the dropdown based on "searchfieldsToDisplay"

[nfilippi_splunk]

This is advanced xml

[somesoni2]

+1, I already asked this a month back but not resolved yet. http://answers.splunk.com/answers/115727/splunk-6-simple-xml-dropdown-how-to-select-first-value-in-t...

[harshal_chakran]

Hi Chris,
If you have got the solution can you please share it with me.Even I'm facing the same issue.