https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552806#M38311 <P>Hi.. thank you for replying. I have tried combining the values using mvjoin command. But once these values are put together in a row with a delimiter, i was not able to display the other column which having individual values of the dropdown. Do you have any solution for this?</P> Mon, 24 May 2021 15:53:29 GMT anooshac 2021-05-24T15:53:29Z https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552761#M38298 <P>Hi all,</P><P>I have a dynamic drop down which has the values from a search query. I want to assign all those values to a token for &lt;condition Label= "All"&gt;. Also i want those values to be delimited during the assignment. I have tried a lot and failed to implement. Can anyone please help me with this??</P> Mon, 24 May 2021 12:11:37 GMT https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552761#M38298 anooshac 2021-05-24T12:11:37Z https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552765#M38301 <P>Can you change your query used to populate the drop down so that an extra row is returned with the label field set to all and the value field set the all the other values delimited as you would like?</P> Mon, 24 May 2021 12:19:41 GMT https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552765#M38301 ITWhisperer 2021-05-24T12:19:41Z https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552806#M38311 <P>Hi.. thank you for replying. I have tried combining the values using mvjoin command. But once these values are put together in a row with a delimiter, i was not able to display the other column which having individual values of the dropdown. Do you have any solution for this?</P> Mon, 24 May 2021 15:53:29 GMT https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552806#M38311 anooshac 2021-05-24T15:53:29Z https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552808#M38312 <P>The first part sets up some dummy data. Then append and empty event, collect all the other values (this is added to all events but is removed later), set the label field (or whatever yours is called) to "All", and set the value field (or whatever yours is called) to the joined multivalue, delimiting by whatever you need for your value. Finally, limit the returned fields to be just the ones your want (not strictly necessary as you are specifying which field to use as the label and which to use as the value anyway).</P><LI-CODE lang="markup">| gentimes start=-1 increment=4h | rename starttime as _time | fields _time | streamstats count as row | eval label=mvindex(split("ABCDEF",""),(row - 1)%6) | eval value=mvindex(split("pqrstu",""),(row - 1)%6) | table label value | append [| makeresults] | eventstats values(value) as allvalues | fillnull value="All" label | eval value=if(isnull(value),mvjoin(allvalues," "),value) | fields label value | table label value</LI-CODE><P>You may want to play around with this so that the events are returned in the order you want e.g. All as the first item.</P><P>&nbsp;</P> Mon, 24 May 2021 16:38:39 GMT https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552808#M38312 ITWhisperer 2021-05-24T16:38:39Z https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552854#M38320 <P>Thank you for the answer. This works good for fixed values. any idea on how to do that for dynamic values? Because the dropdown in my dashboard has the values fetched by a query which depends on different files.</P> Tue, 25 May 2021 04:51:02 GMT https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552854#M38320 anooshac 2021-05-25T04:51:02Z https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552855#M38321 <P>The first part should be replaced with your query that currently generates the labels and values for the dropdown.</P> Tue, 25 May 2021 04:54:25 GMT https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552855#M38321 ITWhisperer 2021-05-25T04:54:25Z https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552857#M38322 <P>Yeah i got it.. In my query i only generate values.. Can it be done without the labels? Or is there any other technique by which i can assign all the values in the drop down to a single token with delimiter? Sorry for asking so many questions i am just learning the Splunk..</P> Tue, 25 May 2021 05:24:51 GMT https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552857#M38322 anooshac 2021-05-25T05:24:51Z https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552858#M38323 <P>Your dashboard XML will have two elements &lt;fieldForLabel&gt; and &lt;fieldForValue&gt;. You probably have these set to be the same field name (the field returned by your query). Simply change one of them to another name and then in your search query, assign the new field name to the value of your existing field.</P><LI-CODE lang="markup">&lt;fieldForLabel&gt;originalField&lt;/fieldForLabel&gt; &lt;fieldForValue&gt;valueField&lt;/fieldForValue&gt;</LI-CODE><P>and</P><LI-CODE lang="markup">...search | eval valueField=originalField</LI-CODE> Tue, 25 May 2021 05:28:52 GMT https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552858#M38323 ITWhisperer 2021-05-25T05:28:52Z https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552868#M38324 <P>Thank you.. I will try this..</P><P>do you any simple method to just assign all the values to the token?</P><P>&lt;condition label="All"&gt;<BR />&lt;set token="Tok_all"&gt;"All the values should be should be assigned here"&lt;/set&gt;</P><P>&lt;/condition&gt;</P><P>Thank you in advance..</P><P>&nbsp;</P> Tue, 25 May 2021 05:53:22 GMT https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552868#M38324 anooshac 2021-05-25T05:53:22Z https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552896#M38325 <P>If I knew of a way to do this as you describe, I would probably have told you. There seems to be only one chance to generate dynamic content for the dropdown and that is through the search query, so you need to exploit that to give you all the dynamic content you require.</P> Tue, 25 May 2021 07:33:41 GMT https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552896#M38325 ITWhisperer 2021-05-25T07:33:41Z https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552917#M38327 <P>I am sorry for that... Just asked if there are any methods for that.. Thank you so much for the help.. I'll try this only and implement it..</P> Tue, 25 May 2021 10:18:48 GMT https://community.splunk.com/t5/Dashboards-Visualizations/pass-all-the-values-of-a-dropdown-to-a-token/m-p/552917#M38327 anooshac 2021-05-25T10:18:48Z