topic Re: Make a SimpleXML multiselect revert to default value upon emptying box in Dashboards & Visualizations

Make a SimpleXML multiselect revert to default value upon emptying box

Jason — Thu, 16 Apr 2015 15:16:04 GMT

I have a (Splunk 6.x+ SimpleXML) multiselect dropdown populating a token that is used by other charts on a dashboard.

The input references a static choice to ensure "ANY" (a value of fieldname=*) gets passed upon loading the dashboard.

Users can select one or more other values, remove the default ANY if desired, and it works fine.

However, when removing the last item in the multiselect box, the charts disappear, as apparently the token is set back to null. How do I ensure that the token is filled (at least on the back end) with fieldname=* (or at least *) when this happens, to keep the charts visible at all times?

Re: Make a SimpleXML multiselect revert to default value upon emptying box

dmaislin_splunk — Thu, 16 Apr 2015 15:36:27 GMT

In your search, add an eval=if(isnull(myfield),"*",myfield)

So your search might look like sourcetype=xyz $MYFIELDTOKEN$ | eval=if(isnull(myfield),"*",myfield) | blah blah blah....

Let me know if that works.

Re: Make a SimpleXML multiselect revert to default value upon emptying box

Jason — Tue, 21 Apr 2015 10:15:36 GMT

The problem is that if the search (in my case a postprocess, but I think it would work on normal searches like yours as well) calls a token, and that token is now nonexistent (due to the multiselect box being emptied out) the search will not run, and will show "waiting for data". I need to force the first option so the chart never goes blank.

Re: Make a SimpleXML multiselect revert to default value upon emptying box

Jason — Tue, 21 Apr 2015 10:17:38 GMT

Thanks to one of my colleagues in Professional Services, this javascript will ensure that if a multiselect box is emptied out, the first choice gets added in again.

https://gist.github.com/hobbes3/7c52b67c1de5ba4d9dfe

Copy this file into your app, restart Splunk, and add script="multiselect_force_default.js" to your opening dashboard or form tag.

Re: Make a SimpleXML multiselect revert to default value upon emptying box

jeffland — Tue, 21 Apr 2015 11:40:21 GMT

You might be interested in this question/answer as well.

Re: Make a SimpleXML multiselect revert to default value upon emptying box

Jason — Tue, 21 Apr 2015 11:55:50 GMT

Interesting. That seems to solve an issue my customer hadn't asked about, which is ALL remaining in the box upon selecting of something additional. This answer solves the removal of all selected items "breaking" the chart due to no input to the token. I'll have to take a look at your answer when I return to that client.

Re: Make a SimpleXML multiselect revert to default value upon emptying box

support0 — Fri, 26 Feb 2016 09:09:58 GMT

Great one 🙂

Re: Make a SimpleXML multiselect revert to default value upon emptying box

ashleyherbert — Sat, 17 Feb 2018 04:12:37 GMT

Just thought I'd post an alternative way of doing this. I'm not a big fan of adding javascript to my dashboards, so I've found a way to do this by adjusting the token for the input using the change & eval attributes. See the example below from one of our dashboards:

    <input type="multiselect" token="host" searchWhenChanged="true">
      <label>Hosts</label>
      <search base="lookup">
        <query>search $env$ | dedup host</query>
      </search>
      <valuePrefix>host=</valuePrefix>
      <delimiter> OR </delimiter>
      <default>*</default>
      <choice value="*">All</choice>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <change>
        <eval token="form.host">if(mvcount('form.host')=0,"*",if(mvcount('form.host')!=1,mvfilter('form.host'!="*"),'form.host'))</eval>
      </change>
    </input>

This will reset the token to 'All' if no options are selected, and will remove the 'All' option if more than 1 are selected.

Re: Make a SimpleXML multiselect revert to default value upon emptying box

shaskell_splunk — Wed, 08 May 2019 20:18:48 GMT

There's no need to use this Javascript on 7.x. If you set a default value for the multi-select you can't de-select it such that it causes the viz to disappear. The default can't be removed from the multi-select.