I have a simple dashboard dropdown filter with two values - Yes, No (indicating whether a user is currently online or not). I have my searches working when a value is selected from the dropdown. But when nothing is selected the panel says "Search is waiting for input..." This seems like it would be a very common thing, but I can't find my answer anywhere in Splunk documentation or Splunk Answers.
Give your dropdown a default value and the search will run.
Thanks Rich. That works, but what I'm really trying to do is make it run for everything. For example, the Yes shows me that 72 people are currently online at a location; the No shows me that 27 people are not currently online at that location. I need to be able to not select a particular value in that drop-down and see that 99 people are in that location. One of my views is a simple pie chart showing who's online/offline. I did create a static list with three values Yes, No, All. The All label just gets a value of *, which works in this case because the particular field is always populated. This particular workaround won't cut it in the future if I need to do this for a field where NULL is allowed. I hope that makes sense.
Add a custom value:
"All"; *
This will allow the user to select "All" and set the token to "*". Then, set this as the default.
Thanks Jacob. That's what I ended up doing. It works in this particular instance because this Yes/No field is always populated. But this won't work if it's for a field that can have Null values because if I add field="*" to my search then it only pulls back events with something in that field.