Dashboards & Visualizations

What do I need to do to make my dashboard panel searches run whether or not I've selected a value from my dropdown?

gregblair
New Member

I have a simple dashboard dropdown filter with two values - Yes, No (indicating whether a user is currently online or not). I have my searches working when a value is selected from the dropdown. But when nothing is selected the panel says "Search is waiting for input..." This seems like it would be a very common thing, but I can't find my answer anywhere in Splunk documentation or Splunk Answers.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Give your dropdown a default value and the search will run.

---
If this reply helps you, Karma would be appreciated.

gregblair
New Member

Thanks Rich. That works, but what I'm really trying to do is make it run for everything. For example, the Yes shows me that 72 people are currently online at a location; the No shows me that 27 people are not currently online at that location. I need to be able to not select a particular value in that drop-down and see that 99 people are in that location. One of my views is a simple pie chart showing who's online/offline. I did create a static list with three values Yes, No, All. The All label just gets a value of *, which works in this case because the particular field is always populated. This particular workaround won't cut it in the future if I need to do this for a field where NULL is allowed. I hope that makes sense.

0 Karma

jacobpevans
Motivator

Add a custom value:

"All"; *

This will allow the user to select "All" and set the token to "*". Then, set this as the default.

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

gregblair
New Member

Thanks Jacob. That's what I ended up doing. It works in this particular instance because this Yes/No field is always populated. But this won't work if it's for a field that can have Null values because if I add field="*" to my search then it only pulls back events with something in that field.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...