Hi All,
I have dashboard created in Splunk 6, simple xml. It has a dropdown input which is getting populated from a lookup file. I would like to select the first value in the dropdown, when the dashboard is loaded.
Any idea how to do the same? I am breaking my head for 3 hrs but got nothing.
Thanks in advance.
As of 6.0.2, you have the ability to configure the input to populate with the first selection on page load. It should look something like this:
<input type="dropdown" token="sourcetype" searchWhenChanged="true">
<label>Sourcetype</label>
<selectFirstChoice>true</selectFirstChoice>
<prefix>sourcetype="</prefix>
<suffix>"</suffix>
<choice value="*">ANY</choice>
<populatingSearch fieldForLabel="sourcetype" fieldForValue="sourcetype" earliest="-24h" latest="now">index=_internal
| stats count by sourcetype
| sort asc sourcetype</populatingSearch>
</input>
As of 6.0.2, you have the ability to configure the input to populate with the first selection on page load. It should look something like this:
<input type="dropdown" token="sourcetype" searchWhenChanged="true">
<label>Sourcetype</label>
<selectFirstChoice>true</selectFirstChoice>
<prefix>sourcetype="</prefix>
<suffix>"</suffix>
<choice value="*">ANY</choice>
<populatingSearch fieldForLabel="sourcetype" fieldForValue="sourcetype" earliest="-24h" latest="now">index=_internal
| stats count by sourcetype
| sort asc sourcetype</populatingSearch>
</input>
Thanks its working on 6.0.2 Splunk. Just had to remove the "*, ANY" part.
Unfortunately it seems to work in version 5.0.3. It takes the first value of my input lookup file which is NOT what I want. I want it to just not run and allow the user to select to search. Guess I need to upgrade to 6 and you need to downgrade to 5 🙂
Same issue, here is the code that I am using, and its not auto populating.
<input type="dropdown" token="host">
<label>Host</label>
<default>All Sites</default>
<choice value="*">All Sites</choice>
<populatingSearch fieldForValue="host" fieldForLabel="host">
<![CDATA[| inputlookup current_connections_dropdown.csv
| fields host
| dedup host
| sort host]]>
</populatingSearch>
</input>
Upgrade to 6.0.2 Maintenance version and then use options mentioned in the accepted answer. The property is not present in documentation though.