<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Handling the ALL token in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Why-when-Handling-the-ALL-token-the-code-doesn-t-work/m-p/592843#M48633</link>
    <description>&lt;P&gt;Your issue is not really with the dropdown, it is with the where command&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| where STATUS = "*"&lt;/LI-CODE&gt;&lt;P&gt;would not find all events with any value for status.&lt;/P&gt;&lt;P&gt;Either use&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| search STATUS = "$Status$"&lt;/LI-CODE&gt;&lt;P&gt;Or change the dropdown to&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;    &amp;lt;input type="dropdown" token="Status" searchWhenChanged="false"&amp;gt;
      &amp;lt;label&amp;gt;Job Status&amp;lt;/label&amp;gt;
      &amp;lt;choice value=".*"&amp;gt;ALL&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="SUCCESS"&amp;gt;SUCCESS&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="FAILURE"&amp;gt;FAILURE&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="RUNNING"&amp;gt;RUNNING&amp;lt;/choice&amp;gt;
      &amp;lt;default&amp;gt;.*&amp;lt;/default&amp;gt;
      &amp;lt;initialValue&amp;gt;.*&amp;lt;/initialValue&amp;gt;
    &amp;lt;/input&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;and use&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| where match(STATUS, "$Status$")&lt;/LI-CODE&gt;</description>
    <pubDate>Thu, 07 Apr 2022 06:50:32 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2022-04-07T06:50:32Z</dc:date>
    <item>
      <title>Why when Handling the ALL token, the code doesn't work?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Why-when-Handling-the-ALL-token-the-code-doesn-t-work/m-p/592795#M48631</link>
      <description>&lt;P&gt;We have the following -&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;    &amp;lt;input type="dropdown" token="Status" searchWhenChanged="false"&amp;gt;
      &amp;lt;label&amp;gt;Job Status&amp;lt;/label&amp;gt;
      &amp;lt;choice value="*"&amp;gt;ALL&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="SUCCESS"&amp;gt;SUCCESS&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="FAILURE"&amp;gt;FAILURE&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="RUNNING"&amp;gt;RUNNING&amp;lt;/choice&amp;gt;
      &amp;lt;default&amp;gt;*&amp;lt;/default&amp;gt;
      &amp;lt;initialValue&amp;gt;*&amp;lt;/initialValue&amp;gt;
    &amp;lt;/input&amp;gt;&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;In the code the following works just fine -&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;| where STATUS = "$Status$"&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Except for the ALL token as the code would be -&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;| where STATUS = "*"&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Instead of -&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;| where STATUS = *&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;What can be done?&lt;/P&gt;</description>
      <pubDate>Thu, 07 Apr 2022 15:27:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Why-when-Handling-the-ALL-token-the-code-doesn-t-work/m-p/592795#M48631</guid>
      <dc:creator>danielbb</dc:creator>
      <dc:date>2022-04-07T15:27:50Z</dc:date>
    </item>
    <item>
      <title>Re: Handling the ALL token</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Why-when-Handling-the-ALL-token-the-code-doesn-t-work/m-p/592843#M48633</link>
      <description>&lt;P&gt;Your issue is not really with the dropdown, it is with the where command&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| where STATUS = "*"&lt;/LI-CODE&gt;&lt;P&gt;would not find all events with any value for status.&lt;/P&gt;&lt;P&gt;Either use&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| search STATUS = "$Status$"&lt;/LI-CODE&gt;&lt;P&gt;Or change the dropdown to&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;    &amp;lt;input type="dropdown" token="Status" searchWhenChanged="false"&amp;gt;
      &amp;lt;label&amp;gt;Job Status&amp;lt;/label&amp;gt;
      &amp;lt;choice value=".*"&amp;gt;ALL&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="SUCCESS"&amp;gt;SUCCESS&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="FAILURE"&amp;gt;FAILURE&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="RUNNING"&amp;gt;RUNNING&amp;lt;/choice&amp;gt;
      &amp;lt;default&amp;gt;.*&amp;lt;/default&amp;gt;
      &amp;lt;initialValue&amp;gt;.*&amp;lt;/initialValue&amp;gt;
    &amp;lt;/input&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;and use&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| where match(STATUS, "$Status$")&lt;/LI-CODE&gt;</description>
      <pubDate>Thu, 07 Apr 2022 06:50:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Why-when-Handling-the-ALL-token-the-code-doesn-t-work/m-p/592843#M48633</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2022-04-07T06:50:32Z</dc:date>
    </item>
  </channel>
</rss>

