Dashboards & Visualizations

How to set a form input default value in 6.5.0?

frobinson_splun
Splunk Employee
Splunk Employee

If I want to set a form input default value, what is the correct Simple XML syntax in software version 6.5.0? For example, how would I update the following Simple XML source code to ensure that the "All" choice value is selected as a default?

<input token="selected_sourcetype" type="checkbox">
  <label>Sourcetype</label>
  <choice value=" ">All</choice>
  <choice value="unknown">unknown</choice>
  <search>
    <query>index=_internal | stats count by sourcetype</query>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>sourcetype</fieldForValue>
  <default/>
</input>
1 Solution

frobinson_splun
Splunk Employee
Splunk Employee

The workaround is to set the value explicitly to the empty string.

<default></default>

For the example Simple XML code, make this update to cause the "All" choice value to be set as a default.

  <input token="selected_sourcetype" type="checkbox">
   <label>Sourcetype</label>
   <choice value=" ">All</choice>
   <choice value="unknown">unknown</choice>
   <search>
     <query>index=_internal | stats count by sourcetype</query>
   </search>
   <fieldForLabel>sourcetype</fieldForLabel>
   <fieldForValue>sourcetype</fieldForValue>
   <default><default/>
 </input>

View solution in original post

frobinson_splun
Splunk Employee
Splunk Employee

The workaround is to set the value explicitly to the empty string.

<default></default>

For the example Simple XML code, make this update to cause the "All" choice value to be set as a default.

  <input token="selected_sourcetype" type="checkbox">
   <label>Sourcetype</label>
   <choice value=" ">All</choice>
   <choice value="unknown">unknown</choice>
   <search>
     <query>index=_internal | stats count by sourcetype</query>
   </search>
   <fieldForLabel>sourcetype</fieldForLabel>
   <fieldForValue>sourcetype</fieldForValue>
   <default><default/>
 </input>

rjthibod
Champion

This applies to previous versions of Splunk Enterprise as well. It used to hang me up a lot.

frobinson_splun
Splunk Employee
Splunk Employee

Hi @rjthibod,
Thanks for your note. I'd be interested to know the previous versions where you are seeing this behavior. So far, we have only observed it affecting version 6.5. Can you let me know where you noticed it?

0 Karma

rjthibod
Champion

I am petty sure I had issues in 6.3.1 or 6.3.2, but can't be 100% sure anymore. The scenario no longer applies to me due to other changes I made to how I was doing things with inputs.

frobinson_splun
Splunk Employee
Splunk Employee

Ok, thanks for these notes!

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...