Splunk Search

How to make the dashboard to display latest result by default

Azwaliyana
Path Finder

I have made my search query for all time because I have created dropdown for month date and year. But I want the search result to always display the latest result. How can I do that?

I pass the date month and year to the search query. But f or the default, I want the dashboard to always display the latest result

Azwaliyana_0-1641802524883.png

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Azwaliyana,

you can configure you dropdowns to display as default the first result of your search (the first result is the latest!) using something like this example:

 

  <fieldset submitButton="false">
    <input type="time" token="Time">
      <label>Time</label>
      <default>
        <earliest>0</earliest>
        <latest></latest>
      </default>
    </input>
    <input type="dropdown" token="assessment">
      <label>Assessments</label>
      <fieldForLabel>_time</fieldForLabel>
      <fieldForValue>_time</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>
          eventtype=tenable_assessment
          | dedup _time
          | sort -_time
          | table _time
        </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
      <prefix>AssessmentDate="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>

 

In this example, using the selectFirstChoice=True option, your dropdown displays as default the first (latest) result of the search used in the input.

Ciao.

Giuseppe

View solution in original post

Azwaliyana
Path Finder

@gcusello Thank you for the solution

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Azwaliyana,

you can configure you dropdowns to display as default the first result of your search (the first result is the latest!) using something like this example:

 

  <fieldset submitButton="false">
    <input type="time" token="Time">
      <label>Time</label>
      <default>
        <earliest>0</earliest>
        <latest></latest>
      </default>
    </input>
    <input type="dropdown" token="assessment">
      <label>Assessments</label>
      <fieldForLabel>_time</fieldForLabel>
      <fieldForValue>_time</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>
          eventtype=tenable_assessment
          | dedup _time
          | sort -_time
          | table _time
        </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
      <prefix>AssessmentDate="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>

 

In this example, using the selectFirstChoice=True option, your dropdown displays as default the first (latest) result of the search used in the input.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...