Dashboards & Visualizations

How to set a form input default value in 6.5.0?

Splunk Employee
Splunk Employee

If I want to set a form input default value, what is the correct Simple XML syntax in software version 6.5.0? For example, how would I update the following Simple XML source code to ensure that the "All" choice value is selected as a default?

<input token="selected_sourcetype" type="checkbox">
  <label>Sourcetype</label>
  <choice value=" ">All</choice>
  <choice value="unknown">unknown</choice>
  <search>
    <query>index=_internal | stats count by sourcetype</query>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>sourcetype</fieldForValue>
  <default/>
</input>
1 Solution

Splunk Employee
Splunk Employee

The workaround is to set the value explicitly to the empty string.

<default></default>

For the example Simple XML code, make this update to cause the "All" choice value to be set as a default.

  <input token="selected_sourcetype" type="checkbox">
   <label>Sourcetype</label>
   <choice value=" ">All</choice>
   <choice value="unknown">unknown</choice>
   <search>
     <query>index=_internal | stats count by sourcetype</query>
   </search>
   <fieldForLabel>sourcetype</fieldForLabel>
   <fieldForValue>sourcetype</fieldForValue>
   <default><default/>
 </input>

View solution in original post

Splunk Employee
Splunk Employee

The workaround is to set the value explicitly to the empty string.

<default></default>

For the example Simple XML code, make this update to cause the "All" choice value to be set as a default.

  <input token="selected_sourcetype" type="checkbox">
   <label>Sourcetype</label>
   <choice value=" ">All</choice>
   <choice value="unknown">unknown</choice>
   <search>
     <query>index=_internal | stats count by sourcetype</query>
   </search>
   <fieldForLabel>sourcetype</fieldForLabel>
   <fieldForValue>sourcetype</fieldForValue>
   <default><default/>
 </input>

View solution in original post

Champion

This applies to previous versions of Splunk Enterprise as well. It used to hang me up a lot.

Splunk Employee
Splunk Employee

Hi @rjthibod,
Thanks for your note. I'd be interested to know the previous versions where you are seeing this behavior. So far, we have only observed it affecting version 6.5. Can you let me know where you noticed it?

0 Karma

Champion

I am petty sure I had issues in 6.3.1 or 6.3.2, but can't be 100% sure anymore. The scenario no longer applies to me due to other changes I made to how I was doing things with inputs.

Splunk Employee
Splunk Employee

Ok, thanks for these notes!

0 Karma