Splunk 6 Simple xml dropdown, how to select first value in the list

[somesoni2]

Hi All,

I have dashboard created in Splunk 6, simple xml. It has a dropdown input which is getting populated from a lookup file. I would like to select the first value in the dropdown, when the dashboard is loaded.

Any idea how to do the same? I am breaking my head for 3 hrs but got nothing.

Thanks in advance.

[nfilippi_splunk · Accepted solution]

As of 6.0.2, you have the ability to configure the input to populate with the first selection on page load. It should look something like this:

 <input type="dropdown" token="sourcetype" searchWhenChanged="true">
      <label>Sourcetype</label>
      <selectFirstChoice>true</selectFirstChoice>
      <prefix>sourcetype="</prefix>
      <suffix>"</suffix>
      <choice value="*">ANY</choice>
      <populatingSearch fieldForLabel="sourcetype" fieldForValue="sourcetype" earliest="-24h" latest="now">index=_internal
| stats count by sourcetype
| sort asc sourcetype</populatingSearch>
</input>

[somesoni2]

Thanks its working on 6.0.2 Splunk. Just had to remove the "*, ANY" part.

[the_wolverine]

Unfortunately it seems to work in version 5.0.3. It takes the first value of my input lookup file which is NOT what I want. I want it to just not run and allow the user to select to search. Guess I need to upgrade to 6 and you need to downgrade to 5 🙂

[jtrujillo]

Same issue, here is the code that I am using, and its not auto populating.

<input type="dropdown" token="host">
  <label>Host</label>
  <default>All Sites</default>
  <choice value="*">All Sites</choice>

  <populatingSearch fieldForValue="host" fieldForLabel="host">
    <![CDATA[| inputlookup current_connections_dropdown.csv
      | fields host
      | dedup host
      | sort host]]>
  </populatingSearch>
</input>

[somesoni2]

Upgrade to 6.0.2 Maintenance version and then use options mentioned in the accepted answer. The property is not present in documentation though.