Splunk Search

How to make the dashboard to display latest result by default

Azwaliyana
Path Finder

I have made my search query for all time because I have created dropdown for month date and year. But I want the search result to always display the latest result. How can I do that?

I pass the date month and year to the search query. But f or the default, I want the dashboard to always display the latest result

Azwaliyana_0-1641802524883.png

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Azwaliyana,

you can configure you dropdowns to display as default the first result of your search (the first result is the latest!) using something like this example:

 

  <fieldset submitButton="false">
    <input type="time" token="Time">
      <label>Time</label>
      <default>
        <earliest>0</earliest>
        <latest></latest>
      </default>
    </input>
    <input type="dropdown" token="assessment">
      <label>Assessments</label>
      <fieldForLabel>_time</fieldForLabel>
      <fieldForValue>_time</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>
          eventtype=tenable_assessment
          | dedup _time
          | sort -_time
          | table _time
        </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
      <prefix>AssessmentDate="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>

 

In this example, using the selectFirstChoice=True option, your dropdown displays as default the first (latest) result of the search used in the input.

Ciao.

Giuseppe

View solution in original post

Azwaliyana
Path Finder

@gcusello Thank you for the solution

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Azwaliyana,

you can configure you dropdowns to display as default the first result of your search (the first result is the latest!) using something like this example:

 

  <fieldset submitButton="false">
    <input type="time" token="Time">
      <label>Time</label>
      <default>
        <earliest>0</earliest>
        <latest></latest>
      </default>
    </input>
    <input type="dropdown" token="assessment">
      <label>Assessments</label>
      <fieldForLabel>_time</fieldForLabel>
      <fieldForValue>_time</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>
          eventtype=tenable_assessment
          | dedup _time
          | sort -_time
          | table _time
        </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
      <prefix>AssessmentDate="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>

 

In this example, using the selectFirstChoice=True option, your dropdown displays as default the first (latest) result of the search used in the input.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

[Puzzles] Solve, Learn, Repeat: Nested loops in Event Conversion

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...