topic Re: Unable to create dropdown static option that is "All" static options combined in Splunk Enterprise

Why am I unable to create dropdown static option that is "All" static options combined?

Steve_A200 — Tue, 28 Jun 2022 22:24:11 GMT

Hi,

I am trying to get a static option that is "All" the individual static options combined. The mCode field contains different values in different events, and I would like to list all the events with specific mCode value.

when I paste the query into a regular SPL search, I get the correct results, however, in a Dashboard, it tells me "no results found".

The token I am using for the static options is mcode, and all the individual static options are working correctly:

I tried the following mCode Static option: % ... * .... even value1","value2","value3

nothing seems to work in the Dashboard.

Any help would be appreciated.

Re: Unable to create dropdown static option that is "All" static options combined

bowesmana — Tue, 28 Jun 2022 22:20:19 GMT

Is this a single value dropdown?

If you set the value of your 'all' static option to "__ALL__" and then in your where clause do

| where mCode IN ("$mCode$") OR "$mCodes$"="__ALL__"

if it's a single value dropdown, then the IN clause is probably unnecessary, so

| where mCode="$mCode$" OR "$mCodes$"="__ALL__"

Re: Unable to create dropdown static option that is "All" static options combined

Steve_A200 — Wed, 29 Jun 2022 16:40:55 GMT

Unfortunately it is still not providing me any results when I select All.

The dropdown consist of several static values:

name1 -- value1

name2 -- value2

name3 -- value3

and I want All to combine all the values, so

All -- value1 and value2 and value3

Thank you

Re: Unable to create dropdown static option that is "All" static options combined

bowesmana — Wed, 29 Jun 2022 23:54:51 GMT

What does your query look like when you select all? Open the panel results in a new window and see what the search looks like.

Re: Unable to create dropdown static option that is "All" static options combined

Steve_A200 — Mon, 04 Jul 2022 15:54:30 GMT

Thanks for the tip on opening the results into the Panel.

For some reason, the Name field is being used as the value being populated into the SPL query, which is very odd.

I got the results working by entering % in the name field and any character in the value seem to work.

Splunk seems to be ignoring the value field and using only the name field in the dropdown menu, which is a different from the previous entries in the same dropdown menu.

I did manage to get it working for now even though.

Thanks all.