Getting Data In

Set the latest date from search as the default value in dropdown with submit button?

patricianaguit
Explorer

I want to set the latest date from the search as the default value in dropdown, and the submit must be set to true.
Here's my code so far:

  <search>
    <query>index="test_summary_trial" 
|dedup DATE
|eval DATE_ARRANGED1 = strptime(DATE, "%m/%d/%Y")
|sort - ORDER_DATE_ARRANGED1
|stats first(DATE) as DATE_LATEST
      </query>
    <done>
      <set token="currentDate">$result.DATE_LATEST$</set>
    </done>
  </search>
  <fieldset submitButton="true">
    <input type="dropdown" token="date">
      <label> Date</label>
      <fieldForLabel>DATE</fieldForLabel>
      <fieldForValue>DATE</fieldForValue>
      <search>
        <query>index="test_summary_trial" 
|dedup DATE
|eval ORDER_DATE_ARRANGED1 = strptime(DATE, "%m/%d/%Y")
|sort - ORDER_DATE_ARRANGED1
|table DATE</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <default>$currentDate$</default>
    </input>
</fieldset>

The problem is that whenever i set the submitButton to "true", the default value ($currentDate$ token) i set for the Date dropdown isn't working.
Is there a way where I can still set the default value through the token even if the submitButton is set to true?
or
Is there a more efficient way to set the latest date from search as a default value even if the submitButton is set to true?
Thank you for your help in advance 🙂

1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@patricianaguit

Instead of using different search for setting default value can you please try SelectFirstChoice with existing dropdown search?

<selectFirstChoice>true</selectFirstChoice>

eg.

<fieldset submitButton="true">
     <input type="dropdown" token="date">
       <label> Date</label>

       <selectFirstChoice>true</selectFirstChoice>

       <fieldForLabel>DATE</fieldForLabel>
       <fieldForValue>DATE</fieldForValue>
       <search>
         <query>index="test_summary_trial" 
         |dedup DATE
         |eval ORDER_DATE_ARRANGED1 = strptime(DATE, "%m/%d/%Y")
         |sort - ORDER_DATE_ARRANGED1
         |table DATE</query>
         <earliest>0</earliest>
         <latest></latest>
       </search>
     </input>
 </fieldset>

Thanks

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@patricianaguit

Instead of using different search for setting default value can you please try SelectFirstChoice with existing dropdown search?

<selectFirstChoice>true</selectFirstChoice>

eg.

<fieldset submitButton="true">
     <input type="dropdown" token="date">
       <label> Date</label>

       <selectFirstChoice>true</selectFirstChoice>

       <fieldForLabel>DATE</fieldForLabel>
       <fieldForValue>DATE</fieldForValue>
       <search>
         <query>index="test_summary_trial" 
         |dedup DATE
         |eval ORDER_DATE_ARRANGED1 = strptime(DATE, "%m/%d/%Y")
         |sort - ORDER_DATE_ARRANGED1
         |table DATE</query>
         <earliest>0</earliest>
         <latest></latest>
       </search>
     </input>
 </fieldset>

Thanks

patricianaguit
Explorer

thank you 🙂 this worked for me!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@patricianaguit Glad to help you 🙂

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...