How to implement user defaults for a multiselect drop-down input on a shared dashboard?

[lyndac]

I have a dashboard that is shared by 10-15 users. On the dashboard, I have a multiselect drop-down which shows a list of up to 100 items (populated by a search, default selection is "Any" or "*"). The users are interested in different subsets of the list of items. They would like to have the selection default to their own user-defined subset of the main list. So, say

Jon wants his selections to default to items 1,3,6,23, 57
Mel wants her selections to default to items 17, 23, 43,64,88
Jimi wants his selections to default to 2, 75

Mel still wants to see all times 1-100 in her list, but wants the multselect to be set to 17, 23, 43,64,88 when the dashboard loads.

Is this possible to achieve in Splunk? How? My first thought was lookup tables or KV Store, but I don't think either of those can return a list of 1...n items. I would appreciate any help designing this capability that anyone can provide.

Thanks

The current dashboard is Simple XML, but I can convert to using Sideview Utils if necessary.

[jeffland]

You could do this with javascript if you are willing to put in the extra effort. It's not even that hard actually: you simply place a .js file in apps/your_app_name/appserver/static and give it this content:

require([
    'splunkjs/mvc',
    'splunkjs/mvc/utils',
    'splunkjs/ready!',
    'splunkjs/mvc/simplexml/ready!'
], function (mvc, utils) {

    // Get info on user
    var userName = Splunk.util.getConfigValue("USERNAME");

    // Get the specific input
    var multi = mvc.Components.getInstance("multiselect");

    // Change the input values depending on username
    switch (userName) {
        case "Jon": {
            multi.val([1,3,6,23,57]);
        }
        case "Mel": {
            multi.val([17,23,43,64,88]);
        }
        case "Jimi": {
            multi.val([2,75]);
        }
        default: {
            // ... behavior for all other users (can be empty)
        }
    }
});

You then go to the XML of your dashboard and edit the first line from

<form>

to

<form script="your_js_file.js">

In this XML, you'll also give your multiselect an id in order for the js code above to be able to set its values. Locate the input in question, and change it from something like

<input type="multiselect" token="...">

to

<input id="multiselect" type="multiselect" token="...">

Don't forget to restart your splunk once after adding the .js file, otherwise it won't get picked up by splunk. If I confused you, feel free to ask!