show overall data in table if no option is selected in dropdown

[vikas_gopal]

Please suggest how to sow all records in the table if no option or record has been selected in the dropdown. Here is my code , rt now, table is blank initially and it shows data only when I select some value from dropdown.

Select series | dbquery "Finance Database" "select distinct book_type_code "bookcode" from fa_deprn_periods"

50 | dbquery "Finance Database" "select * from fa_deprn_periods where BOOK_TYPE_CODE='$bookcode$' "

[vikas_gopal · Accepted solution]

Thanks jbrodsky_splunk for the quick responce

Actually I have already applied this thing and I took help from splunk example only but still table is blank with wild card or with "All" choice in dropdown .What I understood out of this is since table is base on a query which is further dependent on dropdown option ,now "All" is nowhere in the data which is a kind of mismatch that is why table is blank or showing no record.....as you suggested I have changed my code to

Select series

<choice value="">All

<![CDATA[| dbquery "Finance Database" "select distinct book_type_code "bookcode" from fa_deprn_periods" ]]>

  </input>
</fieldset>

| dbquery "Finance Database" "select * from fa_deprn_periods where BOOK_TYPE_CODE='$bookcode$' "

</table>
</row>

Still no record in the table 😞

[jbrodsky_splunk]

Great to hear that it worked out!

[vikas_gopal]

You are Awsome jbrodsky_splunk
I tried it with % and it works....yipieeeee

[jbrodsky_splunk]

The choice value should not be "All" - that's just what the dropdown should display. All should be substituted with "*" in the actual splunk search query. So the question is, will this query return anything:

| dbquery "Finance Database" "select * from fa_deprn_periods where BOOK_TYPE_CODE='*' "

...when input into a Splunk search outside of your populating search? If no, then there is your answer.

You might try instead where BOOK_TYPE_CODE='%' or where BOOK_TYPE_CODE LIKE '%' and then change the "choice value" field to All if it works.

[jbrodsky_splunk]

You need to add a default value as a wildcard. There's a good example of this in the Splunk 6 Dashboard Examples app which is freely downloadable. Basically, after your "label" tags and before your "populating search" tags you will add this:

<default>*</default>
<choice value="*">All</choice>

You may also consider modifying your fieldset and input tags like this:

<fieldset autoRun="true" submitButton="false">
<input type="dropdown" token="bookcode" searchWhenChanged="true">

Hope that helps.