How to create a drop-down menu that lists the last 6 months with the previous month selected by default?

[gabriel_vasseur]

I want a drop-down menu that lists the last 6 months in antichronological order starting with the current month and ideally with the previous month selected by default.

I want to use a search to generate the choice list, but I only know the | stats count | eval ... trick, which yields only one row of results when I need 6. I reluctantly tried the inelegant solution of using several append subsearches, but that takes forever in "parsing job". There has to be a better solution!

As for selecting the correct default, I have no idea how.

[sundareshr · Accepted solution]

Try this

<form>
  <label>Test Answers</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field2">
      <search>
        <query>| gentimes start=-180 | bin span=1mon endtime | stats count by endtime | eval month=strftime(endtime, "%B") | table month | reverse</query>
      </search>
      <fieldForLabel>month</fieldForLabel>
      <fieldForValue>month</fieldForValue>
      <default>$d$</default>
    </input>
  </fieldset>
  <row>
    <panel depends="$x$">
      <input type="radio" token="d" searchWhenChanged="true">
        <label>field3</label>
        <default>April</default>
        <search>
          <query>| gentimes start=-180 | bin span=1mon endtime | stats count by endtime | eval month=strftime(endtime, "%B") | table month | tail 2 | tail 1</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>
        <fieldForLabel>month</fieldForLabel>
        <fieldForValue>month</fieldForValue>
      </input>
    </panel>
  </row>
</form>

[gabriel_vasseur]

Awesome! I didn't know gentimes.

I was wondering why you put April as an explicit default in the second search. After experimenting, I believe the default causes splunk to ignore the results of the second search, defeating the purpose. Removing the default doesn't work either: by removing the "depends" clause, I could see the radio button was correct but was not selected. However in my earlier searches online I had heard of "selectFirstChoice" and that worked. So in conclusion, your solution is perfect when:

<default>April</default>

Is replaced with:

<selectFirstChoice>true</selectFirstChoice>

Thanks a lot for taking the time to help, much appreciated.

[avneet26]

this code didn't work for me. when I am selecting the month from the drop down i dont see any changes happening in my dashboard.