Installation

Dropdown not populated after version 6 upgrade

Communicator

We have some dropdowns which does not work after upgrade to Version 6.

The dropdowns is populated by a saved search with report acceleration.

The problem is that the dropdown doesn't get fully populated with the search result. Only the first returned row and the "All" is shown.
Also the "All" value is not selected as it should, but instead the first returned row is selected as default.

The same problem exists when i try to populate the dropdown with a normal search:

<populatingSearch fieldfForValue="customer" fieldForLabel="customer"><![CDATA[|savedsearch ListToolCustomer]]></populatingSearch>

The search is working with no problems, when i run it "manually":

|savedsearch ListToolCustomer

This is the simpleXML:

<?xml version='1.0' encoding='utf-8'?>
<form>

  <label>Splunk "List" Tool</label>
  <searchTemplate>
    `SplunkListTool3(customer=$customer$, customer_type=$customer_type$)`
  </searchTemplate>

  <fieldset autoRun="true">    

    <input type="dropdown" token="customer">
      <label>Customer</label>
      <choice value="*">All</choice>
      <populatingSavedSearch fieldfForValue="customer" fieldForLabel="customer">ListToolCustomer</populatingSavedSearch>
    </input>

    <input type="dropdown" token="customer_type">
      <label>Customer Type</label>
      <choice value="*">All</choice>
      <populatingSavedSearch fieldfForValue="customer_type" fieldForLabel="customer_type">ListToolCustomerType</populatingSavedSearch>
    </input>

    <input type="time" searchWhenChanged="true">
      <default>Last 4 hours</default>      
    </input>

  </fieldset>
  <row>
    <table>
      <title>Splunk List Report</title>
      <option name="showPager">true</option>
      <option name="count">500</option>
    </table>
  </row>
</form>

Any ideas on my problem?

1 Solution

Splunk Employee
Splunk Employee

please replace "fieldfForValue" with "fieldForValue"
Dropdowns have
fieldfForValue="customer_type" fieldForLabel="customer_type" (and customer)
they will get data of saved searches if there is specified field in search like
| eval customer_type=sourcetype

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

please replace "fieldfForValue" with "fieldForValue"
Dropdowns have
fieldfForValue="customer_type" fieldForLabel="customer_type" (and customer)
they will get data of saved searches if there is specified field in search like
| eval customer_type=sourcetype

View solution in original post

0 Karma

Communicator

Argh.
I have been reading the XML over and over for those kind of mistakes...

Pretty weird tho, that it worked in version 5.

Thank you very much for your assistance.

0 Karma

Splunk Employee
Splunk Employee

I'd like to try if populatingSavedSearch (ListToolCustomer and ListToolCustomerType) are working outside of form
Using autoRun instead of autorun should give indication at least for "All"
One more fix is searchwhenchanged should be replaced with searchWhenChanged to refresh the Panel after changing time

0 Karma

Communicator

Yes, as described, the searches works just fine when i run the saved search in the searchbar.

autoRun instead of autorun does not set "All" as selected.
searchWhenChanged instead of searchwhenchanged does not refresh the panel after changing time.

I have tried to create a similar dropdown on another Splunk installation, but the problem is the same.

Also im confident, that you easily can replicate this issue on another Splunk installation.

0 Karma

Splunk Employee
Splunk Employee

please use autoRun instead autorun

0 Karma

Communicator

That didnt change anything.

0 Karma