I want a drop-down menu that lists the last 6 months in antichronological order starting with the current month and ideally with the previous month selected by default.
I want to use a search to generate the choice list, but I only know the | stats count | eval ...
trick, which yields only one row of results when I need 6. I reluctantly tried the inelegant solution of using several append
subsearches, but that takes forever in "parsing job". There has to be a better solution!
As for selecting the correct default, I have no idea how.
Try this
<form>
<label>Test Answers</label>
<fieldset submitButton="false">
<input type="dropdown" token="field2">
<search>
<query>| gentimes start=-180 | bin span=1mon endtime | stats count by endtime | eval month=strftime(endtime, "%B") | table month | reverse</query>
</search>
<fieldForLabel>month</fieldForLabel>
<fieldForValue>month</fieldForValue>
<default>$d$</default>
</input>
</fieldset>
<row>
<panel depends="$x$">
<input type="radio" token="d" searchWhenChanged="true">
<label>field3</label>
<default>April</default>
<search>
<query>| gentimes start=-180 | bin span=1mon endtime | stats count by endtime | eval month=strftime(endtime, "%B") | table month | tail 2 | tail 1</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<fieldForLabel>month</fieldForLabel>
<fieldForValue>month</fieldForValue>
</input>
</panel>
</row>
</form>
Try this
<form>
<label>Test Answers</label>
<fieldset submitButton="false">
<input type="dropdown" token="field2">
<search>
<query>| gentimes start=-180 | bin span=1mon endtime | stats count by endtime | eval month=strftime(endtime, "%B") | table month | reverse</query>
</search>
<fieldForLabel>month</fieldForLabel>
<fieldForValue>month</fieldForValue>
<default>$d$</default>
</input>
</fieldset>
<row>
<panel depends="$x$">
<input type="radio" token="d" searchWhenChanged="true">
<label>field3</label>
<default>April</default>
<search>
<query>| gentimes start=-180 | bin span=1mon endtime | stats count by endtime | eval month=strftime(endtime, "%B") | table month | tail 2 | tail 1</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<fieldForLabel>month</fieldForLabel>
<fieldForValue>month</fieldForValue>
</input>
</panel>
</row>
</form>
Awesome! I didn't know gentimes.
I was wondering why you put April as an explicit default in the second search. After experimenting, I believe the default causes splunk to ignore the results of the second search, defeating the purpose. Removing the default doesn't work either: by removing the "depends" clause, I could see the radio button was correct but was not selected. However in my earlier searches online I had heard of "selectFirstChoice" and that worked. So in conclusion, your solution is perfect when:
<default>April</default>
Is replaced with:
<selectFirstChoice>true</selectFirstChoice>
Thanks a lot for taking the time to help, much appreciated.
this code didn't work for me. when I am selecting the month from the drop down i dont see any changes happening in my dashboard.