Select last week as default in the dropdown

[nabeel652]

Hello Splunkers

I have a dropdown that calculates week_start for the last whole year. Then it has to pick "last_week" as default. I noticed that the dropdown, instead of remembering the label, adds the value to <default></default>
 I've tried to calculate last_week as a token and added to <default></default>, which it picks up correctly.  But shows the epoch time in the dropdown instead of selecting the corresponding label "Last Week".
Code for defining the dropdown search and initialising the token $last_week$:

  <fieldset submitButton="false">
    <input type="dropdown" token="week">
      <label>week</label>
      <fieldForLabel>time</fieldForLabel>
      <fieldForValue>start_time</fieldForValue>
      <search>
        <query>| makeresults count=52
| fields - _time
| streamstats count
| eval count=count-1
| eval start_time = relative_time(now(),"-".count."w@w+1d")
| eval time = case(count==1, "Last week", count==0, "Current week", 1==1, strftime(start_time,"%a %d-%b-%Y"))
| table time, start_time
| eval start_time=round(start_time,0)</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <default>$last_week$</default>
      <initialValue>$last_week$</initialValue>
    </input>
  </fieldset>

-- The token initialisation that calculates last week wrt now():

<init>
    <eval token="last_week">relative_time(now(),"-1w@w+1d")</eval>
</init>

[bowesmana · Accepted solution]

@nabeel652  You don't really need the tokens, just add the selectFirstChoice option and make sure last week is sorted first and it will all work, see this dashboard example

<form version="1.1" theme="light">
  <label>LastWeek</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="week">
      <label>week</label>
      <fieldForLabel>time</fieldForLabel>
      <fieldForValue>start_time</fieldForValue>
      <selectFirstChoice>1</selectFirstChoice>
      <search>
        <query>| makeresults count=52
| fields - _time
| streamstats count
| eval count=count-1
| eval start_time = relative_time(now(),"-".count."w@w+1d")
| eval time = case(count==1, "Last week", count==0, "Current week", 1==1, strftime(start_time,"%a %d-%b-%Y"))
| eval order=if(count=1, -1, count)
| sort order
| table time, start_time
| eval start_time=round(start_time,0)
        </query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <change>
        <set token="week_name">$label$</set>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults 
| fields - _time
| eval selection=$week|s$, name=$week_name|s$
| eval Value=strftime(selection, "%F %T")</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

@ 

[scelikok]

Hi @nabeel652,

You should use valid values from the dropdown contents as default and initial settings.  Changing last_week token init to formatted value will help you, please try below;

 <fieldset submitButton="false">
    <input type="dropdown" token="week">
      <label>week</label>
      <fieldForLabel>time</fieldForLabel>
      <fieldForValue>start_time</fieldForValue>
      <search>
        <query>| makeresults count=52
| fields - _time
| streamstats count
| eval count=count-1
| eval start_time = relative_time(now(),"-".count."w@w+1d")
| eval time = case(count==1, "Last week", count==0, "Current week", 1==1, strftime(start_time,"%a %d-%b-%Y"))
| table time, start_time
| eval start_time=round(start_time,0)</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <default>$last_week$</default>
      <initialValue>$last_week$</initialValue>
    </input>
  </fieldset>

-- The token initialisation that calculates last week wrt now():

<init>
    <eval token="last_week">strftime(relative_time(now(),"-1w@w+1d"),"%a %d-%b-%Y")</eval>
</init>