Dashboards & Visualizations

Default selection not appearing with multi drop-downs

beaumaris
Communicator

I have a dashboard with 3 drop-down lists plus a TimeRangePicker. Two lists are populated from .csv lookup files. I want the initial selection on each to show up as 'all'. On the third dropdown (the one populated by providers.csv), the default selection is one of the items from the lookup table even though I have specified 'all'. The Advanced xml layout is the same for each list. Why does the third list not show the specified default selection?

    <!-- The Server dropdown module definitions -->
      <module name="SearchSelectLister" layoutPanel="viewHeader">
        <param name="staticFieldsToDisplay">
          <list>
            <param name="value">*</param>
            <param name="label">all</param>
          </list>
        </param>
        <!-- Populate the Server dropdown (need this done better) -->
        <param name="search">| inputlookup cdn_topology.csv | chart count by Node_IP | rename Node_IP as host</param>
    <!--
        <param name="search">index=summary report=bandwidth_by_server | dedup Server | chart count by S
    erver | rename Server as host</param>
    -->
        <param name="selected">all</param>
        <param name="label">Server:</param>
        <param name="settingToCreate">host_setting</param>
        <param name="searchFieldsToDisplay">
          <list>
            <param name="value">host</param>
            <param name="label">host</param>
          </list>
        </param>
        <param name="searchWhenChanged">True</param>
        <module name="ConvertToIntention">
          <param name="settingToConvert">host_setting</param>
          <param name="intention">
            <param name="name">stringreplace</param>
            <param name="arg">
              <param name="host">
                <param name="default">localhost</param>
                <param name="fillOnEmpty">True</param>
                <param name="value">$target$</param>
              </param>
            </param>
          </param>

      <!-- The Node_Type dropdown module definitions -->
      <module name="SearchSelectLister" layoutPanel="viewHeader">
        <!-- Populate the Node_Type dropdown from a static CSV file -->
        <param name="search">| inputlookup node_types.csv</param>
        <param name="staticFieldsToDisplay">
          <list>
            <param name="value">*</param>
            <param name="label">all</param>
          </list>
        </param>
        <param name="selected">all</param>
        <param name="label">Node_Type:</param>
        <param name="settingToCreate">node_type_setting</param>
        <param name="searchFieldsToDisplay">
          <list>
            <param name="value">Node_Type</param>
            <param name="label">Node_Type</param>
          </list>
        </param>
        <param name="searchWhenChanged">False</param>
        <module name="ConvertToIntention">
          <param name="settingToConvert">node_type_setting</param>
          <param name="intention">
            <param name="name">stringreplace</param>
            <param name="arg">
              <param name="tier">
                <param name="default">all</param>
                <param name="fillOnEmpty">True</param>
                <param name="value">$target$</param>
              </param>
            </param>
          </param>

      <module name="SearchSelectLister" layoutPanel="viewHeader">
        <param name="staticFieldsToDisplay">
          <list>
            <param name="value">*</param>
            <param name="label">all</param>
          </list>
        </param>
        <param name="search">| inputlookup providers.csv | rename Provider as provider </param>
        <param name="selected">all</param>
        <param name="label">Provider:</param>
        <param name="settingToCreate">provider_setting</param>
        <param name="searchFieldsToDisplay">
          <list>
            <param name="value">provider</param>
            <param name="label">provider</param>
          </list>
        </param>
        <param name="searchWhenChanged">True</param>
        <module name="ConvertToIntention">
          <param name="settingToConvert">provider_setting</param>
          <param name="intention">
            <param name="name">stringreplace</param>
            <param name="arg">
              <param name="provider">
                <param name="default">all</param>
                <param name="fillOnEmpty">True</param>
                <param name="value">$target$</param>
              </param>
            </param>
          </param>

          <!-- The Time Range dropdown definition -->
          <module name="TimeRangePicker">
            <param name="searchWhenChanged">True</param>
            <module name="SubmitButton">
              <param name="allowSoftSubmit">True</param>
              <param name="label">Search</param>
Tags (2)
0 Karma

sideview
SplunkTrust
SplunkTrust

Hmm. That should work. And I just checked locally and working off an example in the 'ui_examples' app, the selected param really does appear to work.

You might try omitting the 'selected' param entirely because the 'all' entry would be selected by default even without it.

If neither of those work I'd send it to support as a bug.

Also, you mentioned that the list of options is truncated -- SearchSelectLister takes a param called 'count'. It doesnt list a default in the docs, and the code doesnt send one to splunkd but it's quite possible that splunkd has an implicit default that kicks in.

(go to <splunk-web-host:port>/modules to see the autogenerated docs)

<param name="count">300</param>

On a broader note, if you're spending a lot of time writing views like this you might want to look at the Sideview Utils app on Splunkbase. (full disclosure: i wrote it) That app brings some new modules into the Advanced XML and those modules give developers a different way to do this sort of thing, and among other benefits it's a way that doesn't involve "intentions" at all.

Your SearchSelectListers and ConvertToIntentions rewritten as Pulldown and Search modules is a bit shorter and easier on the eyes.

<!-- The Server dropdown module definitions -->
<module name="Search">
  <param name="search">| inputlookup cdn_topology.csv | chart count by Node_IP | rename Node_IP as host</param>

  <module name="Pulldown">
    <param name="name">host</param>
    <param name="label">Server:</param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="value">$name$</param>
      </list>
    </param>

    <module name="Search">
      <param name="search">| inputlookup node_types.csv</param>

      <module name="Pulldown">
        <param name="name">Node_Type</param>
        <param name="label">Node Type:</param>
        <param name="searchFieldsToDisplay">
          <list>
            <param name="value">$name$</param>
          </list>
        </param>

        <module name="Search">
          <param name="search">| inputlookup providers.csv | rename Provider as provider</param>

          <module name="Pulldown">
            <param name="name">provider</param>
            <param name="label">Provider:</param>
            <param name="searchFieldsToDisplay">
              <list>
                <param name="value">$name$</param>
              </list>
            </param>

but there's a lot more documentation and examples in the app itself.

http://splunk-base.splunk.com/apps/22279/sideview-utils

0 Karma

beaumaris
Communicator

Removing the 'selected' param lets the drop-down populate completely and do the right thing. Since I have specified:


*
all


It looks like the default behavior is to put 'label' at the top of the list and make it the default selection. That's fine, it's not just clear from the docs about the relationship between 'label' and the 'selected' params.

0 Karma

beaumaris
Communicator

The providers.csv has about 300 entries. Looks like this is too many entries to populate a drop-down. When I change the number of entries to 30, it works fine. What is the limit to the number of items that can be in a drop-down list?

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...