Dashboards & Visualizations

How to set a form input default value in 6.5.0?

frobinson_splun
Splunk Employee
Splunk Employee

If I want to set a form input default value, what is the correct Simple XML syntax in software version 6.5.0? For example, how would I update the following Simple XML source code to ensure that the "All" choice value is selected as a default?

<input token="selected_sourcetype" type="checkbox">
  <label>Sourcetype</label>
  <choice value=" ">All</choice>
  <choice value="unknown">unknown</choice>
  <search>
    <query>index=_internal | stats count by sourcetype</query>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>sourcetype</fieldForValue>
  <default/>
</input>
1 Solution

frobinson_splun
Splunk Employee
Splunk Employee

The workaround is to set the value explicitly to the empty string.

<default></default>

For the example Simple XML code, make this update to cause the "All" choice value to be set as a default.

  <input token="selected_sourcetype" type="checkbox">
   <label>Sourcetype</label>
   <choice value=" ">All</choice>
   <choice value="unknown">unknown</choice>
   <search>
     <query>index=_internal | stats count by sourcetype</query>
   </search>
   <fieldForLabel>sourcetype</fieldForLabel>
   <fieldForValue>sourcetype</fieldForValue>
   <default><default/>
 </input>

View solution in original post

frobinson_splun
Splunk Employee
Splunk Employee

The workaround is to set the value explicitly to the empty string.

<default></default>

For the example Simple XML code, make this update to cause the "All" choice value to be set as a default.

  <input token="selected_sourcetype" type="checkbox">
   <label>Sourcetype</label>
   <choice value=" ">All</choice>
   <choice value="unknown">unknown</choice>
   <search>
     <query>index=_internal | stats count by sourcetype</query>
   </search>
   <fieldForLabel>sourcetype</fieldForLabel>
   <fieldForValue>sourcetype</fieldForValue>
   <default><default/>
 </input>

View solution in original post

rjthibod
Champion

This applies to previous versions of Splunk Enterprise as well. It used to hang me up a lot.

frobinson_splun
Splunk Employee
Splunk Employee

Hi @rjthibod,
Thanks for your note. I'd be interested to know the previous versions where you are seeing this behavior. So far, we have only observed it affecting version 6.5. Can you let me know where you noticed it?

0 Karma

rjthibod
Champion

I am petty sure I had issues in 6.3.1 or 6.3.2, but can't be 100% sure anymore. The scenario no longer applies to me due to other changes I made to how I was doing things with inputs.

frobinson_splun
Splunk Employee
Splunk Employee

Ok, thanks for these notes!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!