Dashboards & Visualizations

How to get a default value to work for span in a drop-down form?


I would like to use a drop-down menu to select span.

1 min
5 min
10 min
20 min
1 hour
2 hour

Problem is not to handle the drop-down, but to get the default to work.
span= needs a value.

This is is how I get it to work. But can it be simplified?

    <input type="dropdown" token="Span" searchWhenChanged="true">
      <label>Time span</label>
      <choice value="timechart">Default</choice>
      <choice value="timechart span=1m">1 min</choice>
      <choice value="timechart span=5m">5 min</choice>
      <choice value="timechart span=10m">10 min</choice>
      <choice value="timechart span=20m">20 min</choice>
      <choice value="timechart span=1h">1 hour</choice>
      <choice value="timechart span=2h">2 hour</choice>

And then my search:

my search .. | $Span$ count by server limit=0

I would like some like this:

my search .. | timeshart span=$Span$ count by server limit=0


my search .. | timeshart $Span$ count by server limit=0

But I am not able to get the default to work.

0 Karma

Esteemed Legend

The way you have defined it absolutely should work. What happens when you select default?

0 Karma


I work fine, I just like it more clean. This is work around and I can not see in my search that its a Timechart search.

0 Karma

Esteemed Legend

The way that you did it is just fine, IMHO.

0 Karma


The default value is not available for span option, so give this workaround a try. bins=100 is the default value,so as long as you're not using that option in your timechart, you should be good to use my search .. | timeshart $Span$ count by server limit=0

fixed token name to match the one used in search

  <fieldset submitButton="false">
    <input type="dropdown" token="Span" searchWhenChanged="true">
      <choice value="bins=100">Default</choice>
       <choice value="span=1m">1 min</choice>
       <choice value="span=5m">5 min</choice>
       <choice value="span=10m">10 min</choice>
       <choice value="span=20m">20 min</choice>
       <choice value="span=1h">1 hour</choice>
       <choice value="span=2h">2 hour</choice>
0 Karma


That looks better than mine. But you have a small error. token="span" and $Span$

0 Karma


Hi @lakromani

With that correction, does the answer by @somesoni2 solve your question? If yes, please don't forget to resolve the post by clicking "Accept" directly below his answer.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...