Splunk Search

How to give a default value to an <eval token> calculated in <input> tag in my XML dashboard?

piece
Explorer

My input tag looks like this

 

 

</input>
    <input type="multiselect" token="fruit_name">
      <label>Fruit name</label>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>fruit_name</fieldForLabel>
      <fieldForValue>fruit_name</fieldForValue>
      <search>
        <query>index=splunk query | mvexpand fruit_name
        </query>
      </search>
      <delimiter> </delimiter>
      <change>
        <eval token="fruit">
          <expression>if(isnull($fruit_name$), "//*", $fruit_name$)</expression>
          <default>*</default>
        </eval>
      </change>
    </input>

 

 

I use `fruit` later in a panel in the XML dashboard. The issue is if user doesn’t select anything from the drop down, `fruit_name` still holds value '*' but the panel which uses `fruit` just shows a message `Search is waiting for input...`. How can I make sure that when user doesn’t select anything, along with `fruit_name` `fruit` also holds the default value which is '*'. Please help.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try it this way

        <eval token="fruit">if(isnull($fruit_name$), "//*", $fruit_name$)</eval>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try it this way

        <eval token="fruit">if(isnull($fruit_name$), "//*", $fruit_name$)</eval>
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...