Splunk Search

How to give a default value to an <eval token> calculated in <input> tag in my XML dashboard?

piece
Explorer

My input tag looks like this

 

 

</input>
    <input type="multiselect" token="fruit_name">
      <label>Fruit name</label>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>fruit_name</fieldForLabel>
      <fieldForValue>fruit_name</fieldForValue>
      <search>
        <query>index=splunk query | mvexpand fruit_name
        </query>
      </search>
      <delimiter> </delimiter>
      <change>
        <eval token="fruit">
          <expression>if(isnull($fruit_name$), "//*", $fruit_name$)</expression>
          <default>*</default>
        </eval>
      </change>
    </input>

 

 

I use `fruit` later in a panel in the XML dashboard. The issue is if user doesn’t select anything from the drop down, `fruit_name` still holds value '*' but the panel which uses `fruit` just shows a message `Search is waiting for input...`. How can I make sure that when user doesn’t select anything, along with `fruit_name` `fruit` also holds the default value which is '*'. Please help.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try it this way

        <eval token="fruit">if(isnull($fruit_name$), "//*", $fruit_name$)</eval>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try it this way

        <eval token="fruit">if(isnull($fruit_name$), "//*", $fruit_name$)</eval>
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...