Thanks jbrodsky_splunk for the quick responce
Actually I have already applied this thing and I took help from splunk example only but still table is blank with wild card or with "All" choice in dropdown .What I understood out of this is since table is base on a query which is further dependent on dropdown option ,now "All" is nowhere in the data which is a kind of mismatch that is why table is blank or showing no record.....as you suggested I have changed my code to
Thanks jbrodsky_splunk for the quick responce
Actually I have already applied this thing and I took help from splunk example only but still table is blank with wild card or with "All" choice in dropdown .What I understood out of this is since table is base on a query which is further dependent on dropdown option ,now "All" is nowhere in the data which is a kind of mismatch that is why table is blank or showing no record.....as you suggested I have changed my code to
Great to hear that it worked out!
You are Awsome jbrodsky_splunk
I tried it with % and it works....yipieeeee
The choice value should not be "All" - that's just what the dropdown should display. All should be substituted with "*" in the actual splunk search query. So the question is, will this query return anything:
| dbquery "Finance Database" "select * from fa_deprn_periods where BOOK_TYPE_CODE='*' "
...when input into a Splunk search outside of your populating search? If no, then there is your answer.
You might try instead where BOOK_TYPE_CODE='%' or where BOOK_TYPE_CODE LIKE '%' and then change the "choice value" field to
You need to add a default value as a wildcard. There's a good example of this in the Splunk 6 Dashboard Examples app which is freely downloadable. Basically, after your "label" tags and before your "populating search" tags you will add this:
<default>*</default>
<choice value="*">All</choice>
You may also consider modifying your fieldset and input tags like this:
<fieldset autoRun="true" submitButton="false">
<input type="dropdown" token="bookcode" searchWhenChanged="true">
Hope that helps.