topic Re: Splunk 6.1.5: How to get the default selection from a multiselect drop-down cleared when someone selects another of the populated options in simple XML? in Dashboards & Visualizations

Splunk 6.1.5: How to get the default selection from a multiselect drop-down cleared when someone selects another of the populated options in simple XML?

Lucas_K — Mon, 01 Dec 2014 05:09:23 GMT

Has anyone found a way to get the default selection from a multiselect cleared when someone selects another of the populated options.

Example :

<label>Node</label>
<populatingSearch earliest="-5m" latest="now" fieldForLabel="host" fieldForValue="host">index=blah</populatingSearch>
<choice value="*">All</choice>
<default>*</default>
<delimiter> OR </delimiter>
<valuePrefix>host=</valuePrefix>

This drop down will populate a list of recent hosts so a user can narrow their search. A default of "all" (or "*") allow them to just click submit without knowing a specific host. They can later select a specific host of interest.

The problem is that if they do select another host (by typing a name or selecting it from the drop down) they will need to manually remove the All option. If they don't then the search will show them everything (i'm using an OR delim so they can multiselect hosts).

Re: Splunk 6.1.5: How to get the default selection from a multiselect drop-down cleared when someone selects another of the populated options in simple XML?

jeffland — Mon, 23 Mar 2015 13:03:08 GMT

I have exactly the same issue. Any chance you figured out a solution?

Re: Splunk 6.1.5: How to get the default selection from a multiselect drop-down cleared when someone selects another of the populated options in simple XML?

jeffland — Tue, 24 Mar 2015 09:41:32 GMT

I believe this is a good solution, though it is in JS and not in XML, so you'll have to modify your app code accordingly. In case this is relevant, this was only tested in Splunk 6.2.2.

Listening on a change on the multiselect, we can identify the number of selected items and whether one of the options is "*" (or whatever your "all" option results in). If this is the case, in the second if-clause we check whether the "*" was there first and the user just selected a more specific option or whether some options were selected and the user chose the "any" option. For the former case, we remove the "*" and leave the other options, and for the latter we simply replace the selection with "*". This behavior is based on the assumption that when you select the "any" option, this overrides the more specific options that were already selected. You can of course adjust this behavior to your needs.

Here is a small code example:

var selection = [];
var multi = splunkjs.mvc.Components.getInstance("input1"); // your multiselect id here

multi.on("change", function(){
    // get the current selection
    selection = multi.val();
    // check if there is more than one entry and one of them is "*"
    if (selection.length > 1 && ~(selection.indexOf("*"))) {
        if (selection.indexOf("*") == 0) {
            // "*" was first, remove it and leave rest
            selection.splice(selection.indexOf("*"), 1);
            multi.val(selection);
            multi.render();
        } else {
            // "*" was added later, remove rest and leave "*"
            multi.val("*");
            multi.render();
        }
    }
});

Cheers

Re: Splunk 6.1.5: How to get the default selection from a multiselect drop-down cleared when someone selects another of the populated options in simple XML?

jeandez — Thu, 12 May 2016 12:52:21 GMT

Hello,

i would like to have multiple default value . Is it possible ?

Re: Splunk 6.1.5: How to get the default selection from a multiselect drop-down cleared when someone selects another of the populated options in simple XML?

sivapuvvada — Fri, 13 May 2016 00:20:32 GMT

"input1" is the token value from the multiselect or Lable name ?

Re: Splunk 6.1.5: How to get the default selection from a multiselect drop-down cleared when someone selects another of the populated options in simple XML?

martin_mueller — Wed, 11 Jan 2017 08:52:23 GMT

"input1" is the id of the input.

Re: Splunk 6.1.5: How to get the default selection from a multiselect drop-down cleared when someone selects another of the populated options in simple XML?

martin_mueller — Wed, 11 Jan 2017 08:53:34 GMT

Mild extension: Add this to the outer if to get the default value back after deleting all entries from the list:

} else if (selection.length == 0) {
    // "*" should be inserted if the list is empty
    multi.val("*");
    multi.render();
}

Re: Splunk 6.1.5: How to get the default selection from a multiselect drop-down cleared when someone selects another of the populated options in simple XML?

DataOrg — Tue, 28 Jan 2020 13:47:14 GMT

@martin_mueller how to check for dispaly label instead of value"*".
my multiselect is not a * value so i want to look for a specific label value "ALL Shops"