Dashboards & Visualizations

dropdown Question.

sschmd
Explorer

Dear Splunk Gurus,
I'm new to splunk. Need some help around Dropdown type for building an app.
I tried as follows to create dropdown and is working.




<![CDATA[sourcetype=SQL_report
earliest=-1q|dedup status| stats count by status]]>

*

My dropdown list pick up all available status codes from sourcetype. the values are like SUCCESS,FAILED,RUNNING,NA.

The Q, how do I add a blank field so that the script pickup "",ie: in its fileds?

-chmd

Tags (1)
0 Karma
1 Solution

rsennett_splunk
Splunk Employee
Splunk Employee

Ah. So am i correct in understanding that you want users to be able to select ALL?
That would not be blank or null, which would be "no choice" but All choices, which would be the wildcard *

Either way... above the default tag you can add a tag as follows.

ALL
You can add any static values you like that way...

May I suggest you install the following app?

http://splunk-base.splunk.com/apps/Splunk+Dashboard+Examples

The example you were looking for in this case was the Dropdown example under Simple XML

Cheers.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

rsennett_splunk
Splunk Employee
Splunk Employee

Ah. So am i correct in understanding that you want users to be able to select ALL?
That would not be blank or null, which would be "no choice" but All choices, which would be the wildcard *

Either way... above the default tag you can add a tag as follows.

ALL
You can add any static values you like that way...

May I suggest you install the following app?

http://splunk-base.splunk.com/apps/Splunk+Dashboard+Examples

The example you were looking for in this case was the Dropdown example under Simple XML

Cheers.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

sschmd
Explorer

Thank you, It helped.

0 Karma

sschmd
Explorer

Thank You!!, But this would work only if I have a black row in my report, right?. I am looking for inserting a blank value default so that my fieldset will pick " * "(star) and would pass to default code in it. In such case,my search would pick all fields like "SUCCESS,FAILED,RUNNING,NA." possibilities. Do you think of any other options..

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

There is an option on the dedup command that handles null values called "keepempty" the default is set to false, so it removes the null or blank values.

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Dedup

Try this:

sourcetype=SQL_report earliest=-1q|dedup status keepempty=true | stats count by status

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma

sschmd
Explorer

Thank You!!, But this would work only if I have a black row in my report, right?. I am looking for inserting a blank value default so that my fieldset will pick " * "(star) and would pass to default code in it. In such case,my search would pick all fields like "SUCCESS,FAILED,RUNNING,NA." possibilities. Do you think of any other options..

0 Karma