All Apps and Add-ons

Multiselect pulldown, selecting default values

aadye
Explorer

I have three linked pulldowns, the first one is a regular pulldown and the other two are mutiselects. My problem is that the last pulldown is not populating as it requires a default value for it's search, they include a "All" value, but until it is selected it does not populate as it's value is "" and not "*", how can I select "All"?

My code is below:



<!-- Copyright (C) 2010-2011 Sideview LLC. All Rights Reserved. -->




*
2
False


<![CDATA[source="/reportdata.csv" | search h_region!="h_region" h_building!="h_building" h_name!="h_name"]]>

<module name="Pulldown">
  <param name="float"></param>
  <param name="name">h_region</param>
  <param name="label">Region</param>

  <param name="postProcess">dedup h_region | sort h_region</param>
  <param name="searchFieldsToDisplay">
    <list>
      <param name="label">region</param>
      <param name="value">h_region</param>
    </list>
  </param>

  <module name="Pulldown">
    <param name="float"></param>
    <param name="size">5</param>
    <param name="name">h_building</param>
    <param name="label">Building</param> 
    <param name="separator">+OR+</param>
    <param name="postProcess">search h_region="$h_region$" | sort h_building | dedup h_building</param>
    <param name="staticFieldsToDisplay">
  <list>
    <param name="label">All</param>
    <param name="value">*</param>
      </list>
     </param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="label">h_building</param>
        <param name="value">h_building</param>
      </list>
    </param>


  <module name="Pulldown">
    <param name="float"></param>
    <param name="size">5</param>
    <param name="name">h_name</param>
    <param name="label">Host</param>
    <param name="postProcess">search h_region="$h_region$" h_building="$h_building$" | sort h_name | dedup h_name</param>
    <param name="separator">+OR+</param>
    <param name="staticFieldsToDisplay">
  <list>
    <param name="label">All</param>
    <param name="value">*</param>
      </list>
     </param>
    <param name="searchFieldsToDisplay">
      <list>

        <param name="label">h_name</param>
        <param name="value">h_name</param>

      </list>
    </param>



  </module>
  </module>
</module>



1 Solution

sideview
SplunkTrust
SplunkTrust

Great question. Sorry I haven't answered it until now, but I've been quietly chewing on it.

I can treat this as a bug and have it fixed in a future release. It's a somewhat interesting issue, and how to fix the issue without introducing a bunch more issues is also interesting, but any writeup I've tried of it sounds terribly dull and pedantic so I'll spare you.

To be very brief, a Pulldown selecting itself to "" amounts to selecting itself to a null value, having seen a null value from upstream. However there are in general always null values from upstream therefore selecting itself to All/"" like this would result in it constantly resetting itself to All/"" which would be obviously annoying. Hm. OK that was less pedantic.

I'm afraid for now there's no workaround, but I'll try and get it fixed in the next release.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Great question. Sorry I haven't answered it until now, but I've been quietly chewing on it.

I can treat this as a bug and have it fixed in a future release. It's a somewhat interesting issue, and how to fix the issue without introducing a bunch more issues is also interesting, but any writeup I've tried of it sounds terribly dull and pedantic so I'll spare you.

To be very brief, a Pulldown selecting itself to "" amounts to selecting itself to a null value, having seen a null value from upstream. However there are in general always null values from upstream therefore selecting itself to All/"" like this would result in it constantly resetting itself to All/"" which would be obviously annoying. Hm. OK that was less pedantic.

I'm afraid for now there's no workaround, but I'll try and get it fixed in the next release.

sideview
SplunkTrust
SplunkTrust

This was fixed as a bug and the general behavior of multiselect Pulldowns that do have an "all/*" entry was improved at some point in Sideview Utils 2.X. It seems to have not made it into the release notes but it did happen.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...