Hi,
I use the following search to dynamically populate a drop-down list. However, the default value selected is not in the resulting top-10 table at all.
<input type="dropdown" token="jobname" searchWhenChanged="true">
<label>Select Jobname from Top-10</label>
<populatingSearch fieldForValue="JOBNAME" fieldForLabel="JOBNAME" earliest="-30d@d" latest="now">
<![CDATA[sourcetype=sapsr3_tbtc_1* | eval startmoment=strptime(STRTDATE." ".STRTTIME,"%Y%m%d %H%M%S"), eindmoment=strptime(ENDDATE." ".ENDTIME,"%Y%m%d %H%M%S"), runtime=eindmoment-startmoment | stats sum(runtime) by JOBNAME | sort -sum(runtime) | head 10 | table JOBNAME]]>
</populatingSearch>
<selectFirstChoice>true</selectFirstChoice>
</input>
Running the search as a normal search shows that the selected value is the one at the top of the table before the head 10 and may be even before the sort sum..... has been applied. My guess is that Splunk is applying the selectFirstChoice to intermediate and not the end result of the search. I.e. ZFIU_REVERSE_SDD_PO is the selected value by selectFirstChoice, but is not part of the top-10 drop-down list.
Any thoughts anyone?
Thanks a bunch!
btw Splunk 6.4.1
... View more