Splunk Search

How to make the dashboard to display latest result by default

Azwaliyana
Path Finder

I have made my search query for all time because I have created dropdown for month date and year. But I want the search result to always display the latest result. How can I do that?

I pass the date month and year to the search query. But f or the default, I want the dashboard to always display the latest result

Azwaliyana_0-1641802524883.png

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Azwaliyana,

you can configure you dropdowns to display as default the first result of your search (the first result is the latest!) using something like this example:

 

  <fieldset submitButton="false">
    <input type="time" token="Time">
      <label>Time</label>
      <default>
        <earliest>0</earliest>
        <latest></latest>
      </default>
    </input>
    <input type="dropdown" token="assessment">
      <label>Assessments</label>
      <fieldForLabel>_time</fieldForLabel>
      <fieldForValue>_time</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>
          eventtype=tenable_assessment
          | dedup _time
          | sort -_time
          | table _time
        </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
      <prefix>AssessmentDate="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>

 

In this example, using the selectFirstChoice=True option, your dropdown displays as default the first (latest) result of the search used in the input.

Ciao.

Giuseppe

View solution in original post

Azwaliyana
Path Finder

@gcusello Thank you for the solution

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Azwaliyana,

you can configure you dropdowns to display as default the first result of your search (the first result is the latest!) using something like this example:

 

  <fieldset submitButton="false">
    <input type="time" token="Time">
      <label>Time</label>
      <default>
        <earliest>0</earliest>
        <latest></latest>
      </default>
    </input>
    <input type="dropdown" token="assessment">
      <label>Assessments</label>
      <fieldForLabel>_time</fieldForLabel>
      <fieldForValue>_time</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>
          eventtype=tenable_assessment
          | dedup _time
          | sort -_time
          | table _time
        </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
      <prefix>AssessmentDate="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>

 

In this example, using the selectFirstChoice=True option, your dropdown displays as default the first (latest) result of the search used in the input.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...