All Apps and Add-ons

How to make a multi-select token with dynamic options that defaults to selecting all?

augustallen4
Explorer

I have a dashboard which will dynamically return values in a separate multiselect token based on user input to an initial token. However, I would like the multiselect token to default to having all options selected with the ability to uncheck any option and remove them from results.

The functionality I am looking for is nearly identical to the "Fields to use for predicting" in the Machine Learning Toolkit but I cannot figure out how to see the source code in that app. The only difference is that I would like to default to having all values selected.

0 Karma

pramit46
Contributor

How about appending 'All' to your dynamic resultset, through the query and make it default value?

<Your search resultset>|append [|makeresults |eval columnname="All", columnvalue="*"]

then make this All as default value. you can do it from ui as well as from xml.

0 Karma

augustallen4
Explorer

I'm looking to default to having all the values selected and then a user can remove any values they do not want. If there's a value for ALL then you have to deselect it and then click dozens of other values.

The functionality I'm looking for is more like a "select all" not just making "all" an option. If I could figure out how they did it in the machine learning toolkit that would be perfect.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...