Splunk Search

How to make the dashboard to display latest result by default

Azwaliyana
Path Finder

I have made my search query for all time because I have created dropdown for month date and year. But I want the search result to always display the latest result. How can I do that?

I pass the date month and year to the search query. But f or the default, I want the dashboard to always display the latest result

Azwaliyana_0-1641802524883.png

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Azwaliyana,

you can configure you dropdowns to display as default the first result of your search (the first result is the latest!) using something like this example:

 

  <fieldset submitButton="false">
    <input type="time" token="Time">
      <label>Time</label>
      <default>
        <earliest>0</earliest>
        <latest></latest>
      </default>
    </input>
    <input type="dropdown" token="assessment">
      <label>Assessments</label>
      <fieldForLabel>_time</fieldForLabel>
      <fieldForValue>_time</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>
          eventtype=tenable_assessment
          | dedup _time
          | sort -_time
          | table _time
        </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
      <prefix>AssessmentDate="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>

 

In this example, using the selectFirstChoice=True option, your dropdown displays as default the first (latest) result of the search used in the input.

Ciao.

Giuseppe

View solution in original post

Azwaliyana
Path Finder

@gcusello Thank you for the solution

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Azwaliyana,

you can configure you dropdowns to display as default the first result of your search (the first result is the latest!) using something like this example:

 

  <fieldset submitButton="false">
    <input type="time" token="Time">
      <label>Time</label>
      <default>
        <earliest>0</earliest>
        <latest></latest>
      </default>
    </input>
    <input type="dropdown" token="assessment">
      <label>Assessments</label>
      <fieldForLabel>_time</fieldForLabel>
      <fieldForValue>_time</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>
          eventtype=tenable_assessment
          | dedup _time
          | sort -_time
          | table _time
        </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
      <prefix>AssessmentDate="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>

 

In this example, using the selectFirstChoice=True option, your dropdown displays as default the first (latest) result of the search used in the input.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...