Dashboards & Visualizations

How to set a form input default value in 6.5.0?

frobinson_splun
Splunk Employee
Splunk Employee

If I want to set a form input default value, what is the correct Simple XML syntax in software version 6.5.0? For example, how would I update the following Simple XML source code to ensure that the "All" choice value is selected as a default?

<input token="selected_sourcetype" type="checkbox">
  <label>Sourcetype</label>
  <choice value=" ">All</choice>
  <choice value="unknown">unknown</choice>
  <search>
    <query>index=_internal | stats count by sourcetype</query>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>sourcetype</fieldForValue>
  <default/>
</input>
1 Solution

frobinson_splun
Splunk Employee
Splunk Employee

The workaround is to set the value explicitly to the empty string.

<default></default>

For the example Simple XML code, make this update to cause the "All" choice value to be set as a default.

  <input token="selected_sourcetype" type="checkbox">
   <label>Sourcetype</label>
   <choice value=" ">All</choice>
   <choice value="unknown">unknown</choice>
   <search>
     <query>index=_internal | stats count by sourcetype</query>
   </search>
   <fieldForLabel>sourcetype</fieldForLabel>
   <fieldForValue>sourcetype</fieldForValue>
   <default><default/>
 </input>

View solution in original post

frobinson_splun
Splunk Employee
Splunk Employee

The workaround is to set the value explicitly to the empty string.

<default></default>

For the example Simple XML code, make this update to cause the "All" choice value to be set as a default.

  <input token="selected_sourcetype" type="checkbox">
   <label>Sourcetype</label>
   <choice value=" ">All</choice>
   <choice value="unknown">unknown</choice>
   <search>
     <query>index=_internal | stats count by sourcetype</query>
   </search>
   <fieldForLabel>sourcetype</fieldForLabel>
   <fieldForValue>sourcetype</fieldForValue>
   <default><default/>
 </input>

rjthibod
Champion

This applies to previous versions of Splunk Enterprise as well. It used to hang me up a lot.

frobinson_splun
Splunk Employee
Splunk Employee

Hi @rjthibod,
Thanks for your note. I'd be interested to know the previous versions where you are seeing this behavior. So far, we have only observed it affecting version 6.5. Can you let me know where you noticed it?

0 Karma

rjthibod
Champion

I am petty sure I had issues in 6.3.1 or 6.3.2, but can't be 100% sure anymore. The scenario no longer applies to me due to other changes I made to how I was doing things with inputs.

frobinson_splun
Splunk Employee
Splunk Employee

Ok, thanks for these notes!

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...