Splunk Search

How to make the dashboard to display latest result by default

Azwaliyana
Path Finder

I have made my search query for all time because I have created dropdown for month date and year. But I want the search result to always display the latest result. How can I do that?

I pass the date month and year to the search query. But f or the default, I want the dashboard to always display the latest result

Azwaliyana_0-1641802524883.png

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Azwaliyana,

you can configure you dropdowns to display as default the first result of your search (the first result is the latest!) using something like this example:

 

  <fieldset submitButton="false">
    <input type="time" token="Time">
      <label>Time</label>
      <default>
        <earliest>0</earliest>
        <latest></latest>
      </default>
    </input>
    <input type="dropdown" token="assessment">
      <label>Assessments</label>
      <fieldForLabel>_time</fieldForLabel>
      <fieldForValue>_time</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>
          eventtype=tenable_assessment
          | dedup _time
          | sort -_time
          | table _time
        </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
      <prefix>AssessmentDate="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>

 

In this example, using the selectFirstChoice=True option, your dropdown displays as default the first (latest) result of the search used in the input.

Ciao.

Giuseppe

View solution in original post

Azwaliyana
Path Finder

@gcusello Thank you for the solution

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Azwaliyana,

you can configure you dropdowns to display as default the first result of your search (the first result is the latest!) using something like this example:

 

  <fieldset submitButton="false">
    <input type="time" token="Time">
      <label>Time</label>
      <default>
        <earliest>0</earliest>
        <latest></latest>
      </default>
    </input>
    <input type="dropdown" token="assessment">
      <label>Assessments</label>
      <fieldForLabel>_time</fieldForLabel>
      <fieldForValue>_time</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>
          eventtype=tenable_assessment
          | dedup _time
          | sort -_time
          | table _time
        </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
      <prefix>AssessmentDate="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>

 

In this example, using the selectFirstChoice=True option, your dropdown displays as default the first (latest) result of the search used in the input.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...