Dashboards & Visualizations

Is it possible to set an empty default value for text or drop-down inputs?

gcusello
SplunkTrust
SplunkTrust

Hi at all,

I have some text or drop-down inputs in a dashboard,
Every one of them has "*" as default value.
In this way, I overload my search with unuseful filters
I tried to insert a blank value as default, but my panels wait for the input.
Is it possible to not use the default myfield="*"?
In other words, is it possible to set an empty default for text or drop-down inputs?

Thank you.
Bye.
Giuseppe

0 Karma

Dennis
Explorer

Typo correction:

Hello Giuseppe,

Noticed it's been over 8 years since you posted your question, but came across this post while searching on how to make a text box empty by default......same as you were looking to do.

Was working on a dashboard today, and thought what character is not ever in event data, and is not a character used by SPL for any reason.  The answer was the:  ~

This worked for me, like a charm, in a dashboard text box:   

<initialValue>~</initialValue>
<default>~
</default>

Best regards,   

Dennis_0-1701899394197.png

 

Dennis

0 Karma

dwraesner
Explorer

Hello Giuseppe,

Noticed it's been over 8 years since you posted your question, but came across this post will searching on how to make a text box empty by default.,,,,same as you were looking to do.

Was working on a dashboard today, and thought what character is not ever in event data, and is not a character used by SPL for any reason.  The answer was the:  ~

This worked for me, like a charm, in a dashboard text box:   

<initialValue>~</initialValue>
<default>~
</default>

Best regards,   😎

Dennis

woodcock
Esteemed Legend

I assume you are using tokens for the value of a field like this:

<fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="MyHostToken">
    <label>MyHostToken</label>
    <choice value="abc">host abc</choice>
    <choice value="xyz">host xyz</choice>
    <default>*</default>
  </input>
</fieldset>

Which means that your search looks like this:

<query>index=myIndex host=$MyHostToken$ ...</query>

But you could do the entire clause in your fields like this:

<fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="MyHostClause">
    <label>MyHostClause</label>
    <choice value="host=abc">host abc</choice>
    <choice value="host=xyz">host xyz</choice>
    <default>OR index=myIndex</default>
  </input>
</fieldset>

Which means that your search looks like this:

<query>index=myIndex $MyHostClause$ ...</query>

And when it is run, it looks funny but runs the same:

index=myIndex OR index=myIndex ...

You might be able to figure out how to set a null value for myHostClause (try using a space, but I don't think it will work). If you do, let us know what worked (I am too busy to set this up to play around with it).

0 Karma

gcusello
SplunkTrust
SplunkTrust

this is a part of my dashboard

Search log

<input type="time" searchWhenChanged="false" token="Time">
  <label>Periodo</label>
  <default>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="dropdown" token="Utente" searchWhenChanged="false">
  <default>*</default>
  <choice value="*">All</choice>
  <search>
    <query>tag=GP2 | dedup MATRICOLA | table MATRICOLA | sort MATRICOLA</query>
  </search>
  <fieldForLabel>MATRICOLA</fieldForLabel>
  <fieldForValue>MATRICOLA</fieldForValue>
</input>
<input type="dropdown" token="Cliente" searchWhenChanged="false">
  <choice value="*">All</choice>
  <search>
    <query>tag=GP2 | dedup ID_CLIENTE | table ID_CLIENTE | sort ID_CLIENTE</query>
    <earliest>$Time.earliest$</earliest>
    <latest>$Time.latest$</latest>
  </search>
  <prefix>ID_CLIENTE="</prefix>
  <suffix>"</suffix>
  <fieldForLabel>ID_CLIENTE</fieldForLabel>
  <fieldForValue>ID_CLIENTE</fieldForValue>
  <default>*</default>
</input>
<input type="text" token="esclusione">
  <label>Esclusione</label>
  <prefix>NOT (</prefix>
  <suffix>)</suffix>
  <seed>Termini da escludere</seed>
</input>


<table>
  <title>Log elaborati</title>
  <search>
    <query>tag=GP2 MATRICOLA="$Utente$" $Cliente$ $esclusione$ | table TimeStamp Data_Acq Esito SS Operatore Postazione IDCliente TipoCliente Operazione</query>
    <earliest>$Time.earliest$</earliest>
    <latest>$Time.latest$</latest>
  </search>
  <option name="wrap">false</option>
  <option name="rowNumbers">false</option>
  <option name="dataOverlayMode">none</option>
  <option name="drilldown">row</option>
  <option name="count">20</option>
</table>
0 Karma

gcusello
SplunkTrust
SplunkTrust

I tried with " " and "" but panels are waiting for an input.
This is the problem: I'm not able to pass an empty value, I need to have these two possibilities:
- default: "my_search | ...." instead of "my_search my_field="*" | ...."
- every value "my_search my_field="123" | ...."
Thank you.
Bye.
Giuseppe

0 Karma

woodcock
Esteemed Legend

Did you notice that my original solution was to pass in a repeatable portion of the base search for default? This will make your search "look strange" but will not impact the efficiency or the results. It will work and solve your problem.

0 Karma

muebel
SplunkTrust
SplunkTrust

Could you go to edit source for the dashboard and add it to the question in a script block?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...