Dashboards & Visualizations

Is it possible to set an empty default value for text or drop-down inputs?

gcusello
SplunkTrust
SplunkTrust

Hi at all,

I have some text or drop-down inputs in a dashboard,
Every one of them has "*" as default value.
In this way, I overload my search with unuseful filters
I tried to insert a blank value as default, but my panels wait for the input.
Is it possible to not use the default myfield="*"?
In other words, is it possible to set an empty default for text or drop-down inputs?

Thank you.
Bye.
Giuseppe

0 Karma

Dennis
Explorer

Typo correction:

Hello Giuseppe,

Noticed it's been over 8 years since you posted your question, but came across this post while searching on how to make a text box empty by default......same as you were looking to do.

Was working on a dashboard today, and thought what character is not ever in event data, and is not a character used by SPL for any reason.  The answer was the:  ~

This worked for me, like a charm, in a dashboard text box:   

<initialValue>~</initialValue>
<default>~
</default>

Best regards,   

Dennis_0-1701899394197.png

 

Dennis

0 Karma

dwraesner
Explorer

Hello Giuseppe,

Noticed it's been over 8 years since you posted your question, but came across this post will searching on how to make a text box empty by default.,,,,same as you were looking to do.

Was working on a dashboard today, and thought what character is not ever in event data, and is not a character used by SPL for any reason.  The answer was the:  ~

This worked for me, like a charm, in a dashboard text box:   

<initialValue>~</initialValue>
<default>~
</default>

Best regards,   😎

Dennis

woodcock
Esteemed Legend

I assume you are using tokens for the value of a field like this:

<fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="MyHostToken">
    <label>MyHostToken</label>
    <choice value="abc">host abc</choice>
    <choice value="xyz">host xyz</choice>
    <default>*</default>
  </input>
</fieldset>

Which means that your search looks like this:

<query>index=myIndex host=$MyHostToken$ ...</query>

But you could do the entire clause in your fields like this:

<fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="MyHostClause">
    <label>MyHostClause</label>
    <choice value="host=abc">host abc</choice>
    <choice value="host=xyz">host xyz</choice>
    <default>OR index=myIndex</default>
  </input>
</fieldset>

Which means that your search looks like this:

<query>index=myIndex $MyHostClause$ ...</query>

And when it is run, it looks funny but runs the same:

index=myIndex OR index=myIndex ...

You might be able to figure out how to set a null value for myHostClause (try using a space, but I don't think it will work). If you do, let us know what worked (I am too busy to set this up to play around with it).

0 Karma

gcusello
SplunkTrust
SplunkTrust

this is a part of my dashboard

Search log

<input type="time" searchWhenChanged="false" token="Time">
  <label>Periodo</label>
  <default>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="dropdown" token="Utente" searchWhenChanged="false">
  <default>*</default>
  <choice value="*">All</choice>
  <search>
    <query>tag=GP2 | dedup MATRICOLA | table MATRICOLA | sort MATRICOLA</query>
  </search>
  <fieldForLabel>MATRICOLA</fieldForLabel>
  <fieldForValue>MATRICOLA</fieldForValue>
</input>
<input type="dropdown" token="Cliente" searchWhenChanged="false">
  <choice value="*">All</choice>
  <search>
    <query>tag=GP2 | dedup ID_CLIENTE | table ID_CLIENTE | sort ID_CLIENTE</query>
    <earliest>$Time.earliest$</earliest>
    <latest>$Time.latest$</latest>
  </search>
  <prefix>ID_CLIENTE="</prefix>
  <suffix>"</suffix>
  <fieldForLabel>ID_CLIENTE</fieldForLabel>
  <fieldForValue>ID_CLIENTE</fieldForValue>
  <default>*</default>
</input>
<input type="text" token="esclusione">
  <label>Esclusione</label>
  <prefix>NOT (</prefix>
  <suffix>)</suffix>
  <seed>Termini da escludere</seed>
</input>


<table>
  <title>Log elaborati</title>
  <search>
    <query>tag=GP2 MATRICOLA="$Utente$" $Cliente$ $esclusione$ | table TimeStamp Data_Acq Esito SS Operatore Postazione IDCliente TipoCliente Operazione</query>
    <earliest>$Time.earliest$</earliest>
    <latest>$Time.latest$</latest>
  </search>
  <option name="wrap">false</option>
  <option name="rowNumbers">false</option>
  <option name="dataOverlayMode">none</option>
  <option name="drilldown">row</option>
  <option name="count">20</option>
</table>
0 Karma

gcusello
SplunkTrust
SplunkTrust

I tried with " " and "" but panels are waiting for an input.
This is the problem: I'm not able to pass an empty value, I need to have these two possibilities:
- default: "my_search | ...." instead of "my_search my_field="*" | ...."
- every value "my_search my_field="123" | ...."
Thank you.
Bye.
Giuseppe

0 Karma

woodcock
Esteemed Legend

Did you notice that my original solution was to pass in a repeatable portion of the base search for default? This will make your search "look strange" but will not impact the efficiency or the results. It will work and solve your problem.

0 Karma

muebel
SplunkTrust
SplunkTrust

Could you go to edit source for the dashboard and add it to the question in a script block?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...