dropdown Question.

[sschmd]

Dear Splunk Gurus,
I'm new to splunk. Need some help around Dropdown type for building an app.
I tried as follows to create dropdown and is working.

STATUS
<![CDATA[sourcetype=SQL_report
earliest=-1q|dedup status| stats count by status]]>
*

My dropdown list pick up all available status codes from sourcetype. the values are like SUCCESS,FAILED,RUNNING,NA.

The Q, how do I add a blank field so that the script pickup "",ie: in its fileds?

-chmd

[rsennett_splunk · Accepted solution]

Ah. So am i correct in understanding that you want users to be able to select ALL?
That would not be blank or null, which would be "no choice" but All choices, which would be the wildcard *

Either way... above the default tag you can add a tag as follows.

ALL
You can add any static values you like that way...

May I suggest you install the following app?

http://splunk-base.splunk.com/apps/Splunk+Dashboard+Examples

The example you were looking for in this case was the Dropdown example under Simple XML

Cheers.

[sschmd]

Thank you, It helped.

[sschmd]

Thank You!!, But this would work only if I have a black row in my report, right?. I am looking for inserting a blank value default so that my fieldset will pick " * "(star) and would pass to default code in it. In such case,my search would pick all fields like "SUCCESS,FAILED,RUNNING,NA." possibilities. Do you think of any other options..

[rsennett_splunk]

There is an option on the dedup command that handles null values called "keepempty" the default is set to false, so it removes the null or blank values.

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Dedup

Try this:

sourcetype=SQL_report earliest=-1q|dedup status keepempty=true | stats count by status

[sschmd]

Thank You!!, But this would work only if I have a black row in my report, right?. I am looking for inserting a blank value default so that my fieldset will pick " * "(star) and would pass to default code in it. In such case,my search would pick all fields like "SUCCESS,FAILED,RUNNING,NA." possibilities. Do you think of any other options..