<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Drop-down in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Drop-down/m-p/551785#M91577</link>
    <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225651"&gt;@Khuzair81&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;as&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957"&gt;@richgalloway&lt;/a&gt;,&amp;nbsp;said, you have to add a static option ("All") not associating to it "*" as usual (beacuse in this way you take all the countries) but the list of the wanted countries, e.g.:&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;country="US"&amp;nbsp; OR country="UK" OR country="AUSTRALIA"&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Ciao.&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Giuseppe&lt;/SPAN&gt;&lt;/P&gt;</description>
    <pubDate>Mon, 17 May 2021 06:09:52 GMT</pubDate>
    <dc:creator>gcusello</dc:creator>
    <dc:date>2021-05-17T06:09:52Z</dc:date>
    <item>
      <title>Drop-down</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Drop-down/m-p/551759#M91574</link>
      <description>&lt;P&gt;&lt;STRONG&gt;DROPDOWN&lt;/STRONG&gt; - I want to create one dashboard. While creating Country Dropdown I want only those countries in dropdown which my team support(US, UK, AUSTRALIA ETC.) but we are getting data for All countries.&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;Query&lt;/STRONG&gt; - index=* country="US"&amp;nbsp; OR country="UK" OR country="AUSTRALIA" | table country | dedup country&amp;nbsp;&lt;/P&gt;&lt;P&gt;The above Query give me the perfect result in dropdown.&lt;/P&gt;&lt;P&gt;But I want to add one more option "All" in the dropdown which gives me the above mentioned country data only. Is there anyway?&lt;/P&gt;</description>
      <pubDate>Sun, 16 May 2021 22:47:05 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Drop-down/m-p/551759#M91574</guid>
      <dc:creator>Khuzair81</dc:creator>
      <dc:date>2021-05-16T22:47:05Z</dc:date>
    </item>
    <item>
      <title>Re: Drop-down</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Drop-down/m-p/551763#M91575</link>
      <description>&lt;P&gt;A dashboard input can mix static and dynamic choices.&amp;nbsp; The dynamic choices are those produced by the query shown.&amp;nbsp; Add a static choice called "All" and give it a value ("*" is common) that works with your main query.&lt;/P&gt;</description>
      <pubDate>Mon, 17 May 2021 00:01:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Drop-down/m-p/551763#M91575</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2021-05-17T00:01:31Z</dc:date>
    </item>
    <item>
      <title>Re: Drop-down</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Drop-down/m-p/551785#M91577</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225651"&gt;@Khuzair81&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;as&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957"&gt;@richgalloway&lt;/a&gt;,&amp;nbsp;said, you have to add a static option ("All") not associating to it "*" as usual (beacuse in this way you take all the countries) but the list of the wanted countries, e.g.:&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;country="US"&amp;nbsp; OR country="UK" OR country="AUSTRALIA"&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Ciao.&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Giuseppe&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 17 May 2021 06:09:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Drop-down/m-p/551785#M91577</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2021-05-17T06:09:52Z</dc:date>
    </item>
  </channel>
</rss>

