All Apps and Add-ons

Multiselect pulldown, selecting default values

aadye
Explorer

I have three linked pulldowns, the first one is a regular pulldown and the other two are mutiselects. My problem is that the last pulldown is not populating as it requires a default value for it's search, they include a "All" value, but until it is selected it does not populate as it's value is "" and not "*", how can I select "All"?

My code is below:



<!-- Copyright (C) 2010-2011 Sideview LLC. All Rights Reserved. -->




*
2
False


<![CDATA[source="/reportdata.csv" | search h_region!="h_region" h_building!="h_building" h_name!="h_name"]]>

<module name="Pulldown">
  <param name="float"></param>
  <param name="name">h_region</param>
  <param name="label">Region</param>

  <param name="postProcess">dedup h_region | sort h_region</param>
  <param name="searchFieldsToDisplay">
    <list>
      <param name="label">region</param>
      <param name="value">h_region</param>
    </list>
  </param>

  <module name="Pulldown">
    <param name="float"></param>
    <param name="size">5</param>
    <param name="name">h_building</param>
    <param name="label">Building</param> 
    <param name="separator">+OR+</param>
    <param name="postProcess">search h_region="$h_region$" | sort h_building | dedup h_building</param>
    <param name="staticFieldsToDisplay">
  <list>
    <param name="label">All</param>
    <param name="value">*</param>
      </list>
     </param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="label">h_building</param>
        <param name="value">h_building</param>
      </list>
    </param>


  <module name="Pulldown">
    <param name="float"></param>
    <param name="size">5</param>
    <param name="name">h_name</param>
    <param name="label">Host</param>
    <param name="postProcess">search h_region="$h_region$" h_building="$h_building$" | sort h_name | dedup h_name</param>
    <param name="separator">+OR+</param>
    <param name="staticFieldsToDisplay">
  <list>
    <param name="label">All</param>
    <param name="value">*</param>
      </list>
     </param>
    <param name="searchFieldsToDisplay">
      <list>

        <param name="label">h_name</param>
        <param name="value">h_name</param>

      </list>
    </param>



  </module>
  </module>
</module>



1 Solution

sideview
SplunkTrust
SplunkTrust

Great question. Sorry I haven't answered it until now, but I've been quietly chewing on it.

I can treat this as a bug and have it fixed in a future release. It's a somewhat interesting issue, and how to fix the issue without introducing a bunch more issues is also interesting, but any writeup I've tried of it sounds terribly dull and pedantic so I'll spare you.

To be very brief, a Pulldown selecting itself to "" amounts to selecting itself to a null value, having seen a null value from upstream. However there are in general always null values from upstream therefore selecting itself to All/"" like this would result in it constantly resetting itself to All/"" which would be obviously annoying. Hm. OK that was less pedantic.

I'm afraid for now there's no workaround, but I'll try and get it fixed in the next release.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Great question. Sorry I haven't answered it until now, but I've been quietly chewing on it.

I can treat this as a bug and have it fixed in a future release. It's a somewhat interesting issue, and how to fix the issue without introducing a bunch more issues is also interesting, but any writeup I've tried of it sounds terribly dull and pedantic so I'll spare you.

To be very brief, a Pulldown selecting itself to "" amounts to selecting itself to a null value, having seen a null value from upstream. However there are in general always null values from upstream therefore selecting itself to All/"" like this would result in it constantly resetting itself to All/"" which would be obviously annoying. Hm. OK that was less pedantic.

I'm afraid for now there's no workaround, but I'll try and get it fixed in the next release.

sideview
SplunkTrust
SplunkTrust

This was fixed as a bug and the general behavior of multiselect Pulldowns that do have an "all/*" entry was improved at some point in Sideview Utils 2.X. It seems to have not made it into the release notes but it did happen.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...