https://community.splunk.com/t5/Dashboards-Visualizations/Multiselect-default-to-all/m-p/680866#M55754 <P>I'm trying to create what is effectively a "server" dropdown in a dashboard, where I want to allow people to filter on one or more servers from a lookup.&nbsp; By default, I want the visualization to show for all servers.&nbsp; I have the lookup pulling values, but I'm stuck trying to figure out how to make it so that they don't have to unselect a default "*" value.&nbsp; Ideally, the input is empty by default (or it can show some value like "*" or "all") but once they start selecting individual servers that "all" option is removed.&nbsp; Conversely, if they remove all servers from the filter, it should once again act like "*".</P><P>Here's a stripped-down version of what I'm trying to do:</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">&lt;form version="1.1" theme="dark"&gt; &lt;label&gt;My dashboard&lt;/label&gt; &lt;fieldset submitButton="false"&gt; &lt;input type="time" token="field1"&gt; &lt;label&gt;&lt;/label&gt; &lt;default&gt; &lt;earliest&gt;-5m&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/default&gt; &lt;/input&gt; &lt;input type="multiselect" token="server" searchWhenChanged="true"&gt; &lt;label&gt;server&lt;/label&gt; &lt;search&gt; &lt;query&gt;| inputlookup server_lookup.csv&lt;/query&gt; &lt;/search&gt; &lt;fieldForLabel&gt;server&lt;/fieldForLabel&gt; &lt;fieldForValue&gt;server&lt;/fieldForValue&gt; &lt;delimiter&gt;, &lt;/delimiter&gt; &lt;default&gt;*&lt;/default&gt; &lt;/input&gt; &lt;/fieldset&gt; &lt;row&gt; &lt;panel&gt; &lt;title&gt;Some panel&lt;/title&gt; &lt;chart&gt; &lt;search&gt; &lt;query&gt;index=* server_used IN ($server$) | stats median(some_value)&lt;/query&gt; &lt;earliest&gt;$field1.earliest$&lt;/earliest&gt; &lt;latest&gt;$field1.latest$&lt;/latest&gt; &lt;sampleRatio&gt;1&lt;/sampleRatio&gt; &lt;refresh&gt;1m&lt;/refresh&gt; &lt;refreshType&gt;delay&lt;/refreshType&gt; &lt;/search&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.overflowMode"&gt;ellipsisNone&lt;/option&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.rotation"&gt;0&lt;/option&gt; &lt;option name="charting.axisTitleX.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY2.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisX.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisX.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisY.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY2.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisY2.enabled"&gt;0&lt;/option&gt; &lt;option name="charting.axisY2.scale"&gt;inherit&lt;/option&gt; &lt;option name="charting.chart"&gt;radialGauge&lt;/option&gt; &lt;option name="charting.chart.bubbleMaximumSize"&gt;50&lt;/option&gt; &lt;option name="charting.chart.bubbleMinimumSize"&gt;10&lt;/option&gt; &lt;option name="charting.chart.bubbleSizeBy"&gt;area&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;gaps&lt;/option&gt; &lt;option name="charting.chart.rangeValues"&gt;[0,10,30,100]&lt;/option&gt; &lt;option name="charting.chart.showDataLabels"&gt;none&lt;/option&gt; &lt;option name="charting.chart.sliceCollapsingThreshold"&gt;0.01&lt;/option&gt; &lt;option name="charting.chart.stackMode"&gt;default&lt;/option&gt; &lt;option name="charting.chart.style"&gt;shiny&lt;/option&gt; &lt;option name="charting.gaugeColors"&gt;["0x118832","0xcba700","0xd41f1f"]&lt;/option&gt; &lt;option name="charting.layout.splitSeries"&gt;0&lt;/option&gt; &lt;option name="charting.layout.splitSeries.allowIndependentYRanges"&gt;0&lt;/option&gt; &lt;option name="charting.legend.labelStyle.overflowMode"&gt;ellipsisMiddle&lt;/option&gt; &lt;option name="charting.legend.mode"&gt;standard&lt;/option&gt; &lt;option name="charting.legend.placement"&gt;right&lt;/option&gt; &lt;option name="charting.lineWidth"&gt;2&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="trellis.enabled"&gt;0&lt;/option&gt; &lt;option name="trellis.scales.shared"&gt;1&lt;/option&gt; &lt;option name="trellis.size"&gt;medium&lt;/option&gt; &lt;/chart&gt; &lt;/panel&gt; &lt;/row&gt; &lt;/form&gt;</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Fri, 15 Mar 2024 19:08:03 GMT jrs42 2024-03-15T19:08:03Z https://community.splunk.com/t5/Dashboards-Visualizations/Multiselect-default-to-all/m-p/680866#M55754 <P>I'm trying to create what is effectively a "server" dropdown in a dashboard, where I want to allow people to filter on one or more servers from a lookup.&nbsp; By default, I want the visualization to show for all servers.&nbsp; I have the lookup pulling values, but I'm stuck trying to figure out how to make it so that they don't have to unselect a default "*" value.&nbsp; Ideally, the input is empty by default (or it can show some value like "*" or "all") but once they start selecting individual servers that "all" option is removed.&nbsp; Conversely, if they remove all servers from the filter, it should once again act like "*".</P><P>Here's a stripped-down version of what I'm trying to do:</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">&lt;form version="1.1" theme="dark"&gt; &lt;label&gt;My dashboard&lt;/label&gt; &lt;fieldset submitButton="false"&gt; &lt;input type="time" token="field1"&gt; &lt;label&gt;&lt;/label&gt; &lt;default&gt; &lt;earliest&gt;-5m&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/default&gt; &lt;/input&gt; &lt;input type="multiselect" token="server" searchWhenChanged="true"&gt; &lt;label&gt;server&lt;/label&gt; &lt;search&gt; &lt;query&gt;| inputlookup server_lookup.csv&lt;/query&gt; &lt;/search&gt; &lt;fieldForLabel&gt;server&lt;/fieldForLabel&gt; &lt;fieldForValue&gt;server&lt;/fieldForValue&gt; &lt;delimiter&gt;, &lt;/delimiter&gt; &lt;default&gt;*&lt;/default&gt; &lt;/input&gt; &lt;/fieldset&gt; &lt;row&gt; &lt;panel&gt; &lt;title&gt;Some panel&lt;/title&gt; &lt;chart&gt; &lt;search&gt; &lt;query&gt;index=* server_used IN ($server$) | stats median(some_value)&lt;/query&gt; &lt;earliest&gt;$field1.earliest$&lt;/earliest&gt; &lt;latest&gt;$field1.latest$&lt;/latest&gt; &lt;sampleRatio&gt;1&lt;/sampleRatio&gt; &lt;refresh&gt;1m&lt;/refresh&gt; &lt;refreshType&gt;delay&lt;/refreshType&gt; &lt;/search&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.overflowMode"&gt;ellipsisNone&lt;/option&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.rotation"&gt;0&lt;/option&gt; &lt;option name="charting.axisTitleX.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY2.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisX.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisX.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisY.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY2.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisY2.enabled"&gt;0&lt;/option&gt; &lt;option name="charting.axisY2.scale"&gt;inherit&lt;/option&gt; &lt;option name="charting.chart"&gt;radialGauge&lt;/option&gt; &lt;option name="charting.chart.bubbleMaximumSize"&gt;50&lt;/option&gt; &lt;option name="charting.chart.bubbleMinimumSize"&gt;10&lt;/option&gt; &lt;option name="charting.chart.bubbleSizeBy"&gt;area&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;gaps&lt;/option&gt; &lt;option name="charting.chart.rangeValues"&gt;[0,10,30,100]&lt;/option&gt; &lt;option name="charting.chart.showDataLabels"&gt;none&lt;/option&gt; &lt;option name="charting.chart.sliceCollapsingThreshold"&gt;0.01&lt;/option&gt; &lt;option name="charting.chart.stackMode"&gt;default&lt;/option&gt; &lt;option name="charting.chart.style"&gt;shiny&lt;/option&gt; &lt;option name="charting.gaugeColors"&gt;["0x118832","0xcba700","0xd41f1f"]&lt;/option&gt; &lt;option name="charting.layout.splitSeries"&gt;0&lt;/option&gt; &lt;option name="charting.layout.splitSeries.allowIndependentYRanges"&gt;0&lt;/option&gt; &lt;option name="charting.legend.labelStyle.overflowMode"&gt;ellipsisMiddle&lt;/option&gt; &lt;option name="charting.legend.mode"&gt;standard&lt;/option&gt; &lt;option name="charting.legend.placement"&gt;right&lt;/option&gt; &lt;option name="charting.lineWidth"&gt;2&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="trellis.enabled"&gt;0&lt;/option&gt; &lt;option name="trellis.scales.shared"&gt;1&lt;/option&gt; &lt;option name="trellis.size"&gt;medium&lt;/option&gt; &lt;/chart&gt; &lt;/panel&gt; &lt;/row&gt; &lt;/form&gt;</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Fri, 15 Mar 2024 19:08:03 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Multiselect-default-to-all/m-p/680866#M55754 jrs42 2024-03-15T19:08:03Z https://community.splunk.com/t5/Dashboards-Visualizations/Multiselect-default-to-all/m-p/680873#M55755 <P>Try something like this - note that the case function has to all be on one line for it to parse correctly</P><LI-CODE lang="markup">&lt;form version="1.1" theme="dark"&gt; &lt;label&gt;My dashboard&lt;/label&gt; &lt;fieldset submitButton="false"&gt; &lt;input type="time" token="field1"&gt; &lt;label&gt;&lt;/label&gt; &lt;default&gt; &lt;earliest&gt;-5m&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/default&gt; &lt;/input&gt; &lt;input type="multiselect" token="server" searchWhenChanged="true"&gt; &lt;label&gt;server&lt;/label&gt; &lt;choice value="All"&gt;All&lt;/choice&gt; &lt;search&gt; &lt;query&gt;| inputlookup server_lookup.csv&lt;/query&gt; &lt;/search&gt; &lt;fieldForLabel&gt;server&lt;/fieldForLabel&gt; &lt;fieldForValue&gt;server&lt;/fieldForValue&gt; &lt;prefix&gt;(&lt;/prefix&gt; &lt;valuePrefix&gt;server_used ="&lt;/valuePrefix&gt; &lt;valueSuffix&gt;"&lt;/valueSuffix&gt; &lt;delimiter&gt; OR &lt;/delimiter&gt; &lt;suffix&gt;)&lt;/suffix&gt; &lt;default&gt;All&lt;/default&gt; &lt;change&gt; &lt;eval token="form.server"&gt;case(mvcount('form.server')=0,"All",mvcount('form.server')&amp;gt;1 AND mvfind('form.server',"All")&amp;gt;0,"All",mvcount('form.server')&amp;gt;1 AND mvfind('form.server',"All")=0,mvfilter('form.server'!="All"),1==1,'form.server')&lt;/eval&gt; &lt;eval token="server_choice"&gt;if(mvfind('form.server',"All")=0,"server_used=*",$server$)&lt;/eval&gt; &lt;/change&gt; &lt;/input&gt; &lt;/fieldset&gt; &lt;row&gt; &lt;panel&gt; &lt;title&gt;Some panel&lt;/title&gt; &lt;chart&gt; &lt;search&gt; &lt;query&gt;index=* $server_choice$ | stats median(some_value)&lt;/query&gt; &lt;earliest&gt;$field1.earliest$&lt;/earliest&gt; &lt;latest&gt;$field1.latest$&lt;/latest&gt; &lt;sampleRatio&gt;1&lt;/sampleRatio&gt; &lt;refresh&gt;1m&lt;/refresh&gt; &lt;refreshType&gt;delay&lt;/refreshType&gt; &lt;/search&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.overflowMode"&gt;ellipsisNone&lt;/option&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.rotation"&gt;0&lt;/option&gt; &lt;option name="charting.axisTitleX.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY2.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisX.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisX.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisY.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY2.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisY2.enabled"&gt;0&lt;/option&gt; &lt;option name="charting.axisY2.scale"&gt;inherit&lt;/option&gt; &lt;option name="charting.chart"&gt;radialGauge&lt;/option&gt; &lt;option name="charting.chart.bubbleMaximumSize"&gt;50&lt;/option&gt; &lt;option name="charting.chart.bubbleMinimumSize"&gt;10&lt;/option&gt; &lt;option name="charting.chart.bubbleSizeBy"&gt;area&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;gaps&lt;/option&gt; &lt;option name="charting.chart.rangeValues"&gt;[0,10,30,100]&lt;/option&gt; &lt;option name="charting.chart.showDataLabels"&gt;none&lt;/option&gt; &lt;option name="charting.chart.sliceCollapsingThreshold"&gt;0.01&lt;/option&gt; &lt;option name="charting.chart.stackMode"&gt;default&lt;/option&gt; &lt;option name="charting.chart.style"&gt;shiny&lt;/option&gt; &lt;option name="charting.gaugeColors"&gt;["0x118832","0xcba700","0xd41f1f"]&lt;/option&gt; &lt;option name="charting.layout.splitSeries"&gt;0&lt;/option&gt; &lt;option name="charting.layout.splitSeries.allowIndependentYRanges"&gt;0&lt;/option&gt; &lt;option name="charting.legend.labelStyle.overflowMode"&gt;ellipsisMiddle&lt;/option&gt; &lt;option name="charting.legend.mode"&gt;standard&lt;/option&gt; &lt;option name="charting.legend.placement"&gt;right&lt;/option&gt; &lt;option name="charting.lineWidth"&gt;2&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="trellis.enabled"&gt;0&lt;/option&gt; &lt;option name="trellis.scales.shared"&gt;1&lt;/option&gt; &lt;option name="trellis.size"&gt;medium&lt;/option&gt; &lt;/chart&gt; &lt;/panel&gt; &lt;/row&gt; &lt;/form&gt;</LI-CODE> Fri, 15 Mar 2024 20:51:03 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Multiselect-default-to-all/m-p/680873#M55755 ITWhisperer 2024-03-15T20:51:03Z https://community.splunk.com/t5/Dashboards-Visualizations/Multiselect-default-to-all/m-p/680878#M55756 <P>Edit: I'm working through this, still.&nbsp; Obviously, I changed what I'm working on to post here so I didn't share anything inappropriate, so I may be running into translation issues :).&nbsp;</P><P>Got it working as desired.&nbsp; I changed the query to perform an <FONT face="andale mono,times">IN</FONT> instead of a collection of ORs, like so:</P><P>&nbsp;</P><LI-CODE lang="markup">&lt;prefix&gt;server_used IN (&lt;/prefix&gt; &lt;suffix&gt;)&lt;/suffix&gt; &lt;delimiter&gt;, &lt;/delimiter&gt;</LI-CODE><P>&nbsp;</P><P>but otherwise it's pretty much what you posted.&nbsp; TY!</P> Fri, 15 Mar 2024 22:03:19 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Multiselect-default-to-all/m-p/680878#M55756 jrs42 2024-03-15T22:03:19Z