Installation

Dropdown not populated after version 6 upgrade

polymorphic
Communicator

We have some dropdowns which does not work after upgrade to Version 6.

The dropdowns is populated by a saved search with report acceleration.

The problem is that the dropdown doesn't get fully populated with the search result. Only the first returned row and the "All" is shown.
Also the "All" value is not selected as it should, but instead the first returned row is selected as default.

The same problem exists when i try to populate the dropdown with a normal search:

<populatingSearch fieldfForValue="customer" fieldForLabel="customer"><![CDATA[|savedsearch ListToolCustomer]]></populatingSearch>

The search is working with no problems, when i run it "manually":

|savedsearch ListToolCustomer

This is the simpleXML:

<?xml version='1.0' encoding='utf-8'?>
<form>

  <label>Splunk "List" Tool</label>
  <searchTemplate>
    `SplunkListTool3(customer=$customer$, customer_type=$customer_type$)`
  </searchTemplate>

  <fieldset autoRun="true">    

    <input type="dropdown" token="customer">
      <label>Customer</label>
      <choice value="*">All</choice>
      <populatingSavedSearch fieldfForValue="customer" fieldForLabel="customer">ListToolCustomer</populatingSavedSearch>
    </input>

    <input type="dropdown" token="customer_type">
      <label>Customer Type</label>
      <choice value="*">All</choice>
      <populatingSavedSearch fieldfForValue="customer_type" fieldForLabel="customer_type">ListToolCustomerType</populatingSavedSearch>
    </input>

    <input type="time" searchWhenChanged="true">
      <default>Last 4 hours</default>      
    </input>

  </fieldset>
  <row>
    <table>
      <title>Splunk List Report</title>
      <option name="showPager">true</option>
      <option name="count">500</option>
    </table>
  </row>
</form>

Any ideas on my problem?

1 Solution

afishkin_splunk
Splunk Employee
Splunk Employee

please replace "fieldfForValue" with "fieldForValue"
Dropdowns have
fieldfForValue="customer_type" fieldForLabel="customer_type" (and customer)
they will get data of saved searches if there is specified field in search like
| eval customer_type=sourcetype

View solution in original post

0 Karma

afishkin_splunk
Splunk Employee
Splunk Employee

please replace "fieldfForValue" with "fieldForValue"
Dropdowns have
fieldfForValue="customer_type" fieldForLabel="customer_type" (and customer)
they will get data of saved searches if there is specified field in search like
| eval customer_type=sourcetype

0 Karma

polymorphic
Communicator

Argh.
I have been reading the XML over and over for those kind of mistakes...

Pretty weird tho, that it worked in version 5.

Thank you very much for your assistance.

0 Karma

afishkin_splunk
Splunk Employee
Splunk Employee

I'd like to try if populatingSavedSearch (ListToolCustomer and ListToolCustomerType) are working outside of form
Using autoRun instead of autorun should give indication at least for "All"
One more fix is searchwhenchanged should be replaced with searchWhenChanged to refresh the Panel after changing time

0 Karma

polymorphic
Communicator

Yes, as described, the searches works just fine when i run the saved search in the searchbar.

autoRun instead of autorun does not set "All" as selected.
searchWhenChanged instead of searchwhenchanged does not refresh the panel after changing time.

I have tried to create a similar dropdown on another Splunk installation, but the problem is the same.

Also im confident, that you easily can replicate this issue on another Splunk installation.

0 Karma

afishkin_splunk
Splunk Employee
Splunk Employee

please use autoRun instead autorun

0 Karma

polymorphic
Communicator

That didnt change anything.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...