Dashboards & Visualizations

How to get a default value to work for span in a drop-down form?

lakromani
Builder

I would like to use a drop-down menu to select span.

1 min
5 min
10 min
20 min
1 hour
2 hour
default

Problem is not to handle the drop-down, but to get the default to work.
span= needs a value.

This is is how I get it to work. But can it be simplified?

    <input type="dropdown" token="Span" searchWhenChanged="true">
      <label>Time span</label>
      <default>timechart</default>
      <choice value="timechart">Default</choice>
      <choice value="timechart span=1m">1 min</choice>
      <choice value="timechart span=5m">5 min</choice>
      <choice value="timechart span=10m">10 min</choice>
      <choice value="timechart span=20m">20 min</choice>
      <choice value="timechart span=1h">1 hour</choice>
      <choice value="timechart span=2h">2 hour</choice>
    </input>

And then my search:

my search .. | $Span$ count by server limit=0

I would like some like this:

my search .. | timeshart span=$Span$ count by server limit=0

or

my search .. | timeshart $Span$ count by server limit=0

But I am not able to get the default to work.

0 Karma

woodcock
Esteemed Legend

The way you have defined it absolutely should work. What happens when you select default?

0 Karma

lakromani
Builder

I work fine, I just like it more clean. This is work around and I can not see in my search that its a Timechart search.

0 Karma

woodcock
Esteemed Legend

The way that you did it is just fine, IMHO.

0 Karma

somesoni2
Revered Legend

The default value is not available for span option, so give this workaround a try. bins=100 is the default value,so as long as you're not using that option in your timechart, you should be good to use my search .. | timeshart $Span$ count by server limit=0

fixed token name to match the one used in search

  <fieldset submitButton="false">
    <input type="dropdown" token="Span" searchWhenChanged="true">
      <label>Span</label>
      <choice value="bins=100">Default</choice>
       <choice value="span=1m">1 min</choice>
       <choice value="span=5m">5 min</choice>
       <choice value="span=10m">10 min</choice>
       <choice value="span=20m">20 min</choice>
       <choice value="span=1h">1 hour</choice>
       <choice value="span=2h">2 hour</choice>
    </input>
  </fieldset>
0 Karma

lakromani
Builder

That looks better than mine. But you have a small error. token="span" and $Span$

0 Karma

ppablo
Retired

Hi @lakromani

With that correction, does the answer by @somesoni2 solve your question? If yes, please don't forget to resolve the post by clicking "Accept" directly below his answer.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...