Why is selectFirstChoice selecting an incorrect default value for my drop-down list?

[ewijkmr]

Hi,

I use the following search to dynamically populate a drop-down list. However, the default value selected is not in the resulting top-10 table at all.

      <input type="dropdown" token="jobname" searchWhenChanged="true">
        <label>Select Jobname from Top-10</label>
        <populatingSearch fieldForValue="JOBNAME" fieldForLabel="JOBNAME" earliest="-30d@d" latest="now">
           <![CDATA[sourcetype=sapsr3_tbtc_1* | eval startmoment=strptime(STRTDATE." ".STRTTIME,"%Y%m%d %H%M%S"), eindmoment=strptime(ENDDATE." ".ENDTIME,"%Y%m%d %H%M%S"), runtime=eindmoment-startmoment | stats sum(runtime) by  JOBNAME | sort -sum(runtime) | head 10 | table JOBNAME]]>
        </populatingSearch>        
        <selectFirstChoice>true</selectFirstChoice>
      </input>

Running the search as a normal search shows that the selected value is the one at the top of the table before the head 10 and may be even before the sort sum..... has been applied. My guess is that Splunk is applying the selectFirstChoice to intermediate and not the end result of the search. I.e. ZFIU_REVERSE_SDD_PO is the selected value by selectFirstChoice, but is not part of the top-10 drop-down list.

Any thoughts anyone?

Thanks a bunch!

btw Splunk 6.4.1

[ewijkmr · Accepted solution]

Thanks both for your answers. However, this morning I was going to try the 'num....' answer and the problem had disappeared!

Don't understand because I worked on this for mulitple hours and did numerous refreshes. I think I didn't do a browser stop/start. May be Splunk has 'some caching remnants' that disappear after restart/reboot.

Thanks anyway for your help!

[somesoni2]

Try using this query for your dropdown

sourcetype=sapsr3_tbtc_1* | eval startmoment=strptime(STRTDATE." ".STRTTIME,"%Y%m%d %H%M%S"), eindmoment=strptime(ENDDATE." ".ENDTIME,"%Y%m%d %H%M%S"), runtime=eindmoment-startmoment | stats sum(runtime) as runtime by  JOBNAME | sort -num(runtime) | head 10 | table JOBNAME

[sk314]

Did you try sorting by JOBNAME at the end of the populating seach? Just a thought.