Splunk Search

show overall data in table if no option is selected in dropdown

vikas_gopal
Builder

Please suggest how to sow all records in the table if no option or record has been selected in the dropdown. Here is my code , rt now, table is blank initially and it shows data only when I select some value from dropdown.

| dbquery "Finance Database" "select distinct book_type_code "bookcode" from fa_deprn_periods"
Matching events 50 | dbquery "Finance Database" "select * from fa_deprn_periods where BOOK_TYPE_CODE='$bookcode$' "
Tags (2)
0 Karma
1 Solution

vikas_gopal
Builder

Thanks jbrodsky_splunk for the quick responce

Actually I have already applied this thing and I took help from splunk example only but still table is blank with wild card or with "All" choice in dropdown .What I understood out of this is since table is base on a query which is further dependent on dropdown option ,now "All" is nowhere in the data which is a kind of mismatch that is why table is blank or showing no record.....as you suggested I have changed my code to






<choice value="">All

<![CDATA[| dbquery "Finance Database" "select distinct book_type_code "bookcode" from fa_deprn_periods" ]]>

  </input>
</fieldset>



Matching events
| dbquery "Finance Database" "select * from fa_deprn_periods where BOOK_TYPE_CODE='$bookcode$' "

</table>
</row>


Still no record in the table 😞

View solution in original post

0 Karma

vikas_gopal
Builder

Thanks jbrodsky_splunk for the quick responce

Actually I have already applied this thing and I took help from splunk example only but still table is blank with wild card or with "All" choice in dropdown .What I understood out of this is since table is base on a query which is further dependent on dropdown option ,now "All" is nowhere in the data which is a kind of mismatch that is why table is blank or showing no record.....as you suggested I have changed my code to






<choice value="">All

<![CDATA[| dbquery "Finance Database" "select distinct book_type_code "bookcode" from fa_deprn_periods" ]]>

  </input>
</fieldset>



Matching events
| dbquery "Finance Database" "select * from fa_deprn_periods where BOOK_TYPE_CODE='$bookcode$' "

</table>
</row>


Still no record in the table 😞

0 Karma

jbrodsky_splunk
Splunk Employee
Splunk Employee

Great to hear that it worked out!

0 Karma

vikas_gopal
Builder

You are Awsome jbrodsky_splunk
I tried it with % and it works....yipieeeee

0 Karma

jbrodsky_splunk
Splunk Employee
Splunk Employee

The choice value should not be "All" - that's just what the dropdown should display. All should be substituted with "*" in the actual splunk search query. So the question is, will this query return anything:

| dbquery "Finance Database" "select * from fa_deprn_periods where BOOK_TYPE_CODE='*' "

...when input into a Splunk search outside of your populating search? If no, then there is your answer.

You might try instead where BOOK_TYPE_CODE='%' or where BOOK_TYPE_CODE LIKE '%' and then change the "choice value" field to All if it works.

jbrodsky_splunk
Splunk Employee
Splunk Employee

You need to add a default value as a wildcard. There's a good example of this in the Splunk 6 Dashboard Examples app which is freely downloadable. Basically, after your "label" tags and before your "populating search" tags you will add this:

<default>*</default>
<choice value="*">All</choice>

You may also consider modifying your fieldset and input tags like this:

<fieldset autoRun="true" submitButton="false">
<input type="dropdown" token="bookcode" searchWhenChanged="true">

Hope that helps.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...