All Apps and Add-ons

Multiselect pulldown, selecting default values

aadye
Explorer

I have three linked pulldowns, the first one is a regular pulldown and the other two are mutiselects. My problem is that the last pulldown is not populating as it requires a default value for it's search, they include a "All" value, but until it is selected it does not populate as it's value is "" and not "*", how can I select "All"?

My code is below:



<!-- Copyright (C) 2010-2011 Sideview LLC. All Rights Reserved. -->




*
2
False


<![CDATA[source="/reportdata.csv" | search h_region!="h_region" h_building!="h_building" h_name!="h_name"]]>

<module name="Pulldown">
  <param name="float"></param>
  <param name="name">h_region</param>
  <param name="label">Region</param>

  <param name="postProcess">dedup h_region | sort h_region</param>
  <param name="searchFieldsToDisplay">
    <list>
      <param name="label">region</param>
      <param name="value">h_region</param>
    </list>
  </param>

  <module name="Pulldown">
    <param name="float"></param>
    <param name="size">5</param>
    <param name="name">h_building</param>
    <param name="label">Building</param> 
    <param name="separator">+OR+</param>
    <param name="postProcess">search h_region="$h_region$" | sort h_building | dedup h_building</param>
    <param name="staticFieldsToDisplay">
  <list>
    <param name="label">All</param>
    <param name="value">*</param>
      </list>
     </param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="label">h_building</param>
        <param name="value">h_building</param>
      </list>
    </param>


  <module name="Pulldown">
    <param name="float"></param>
    <param name="size">5</param>
    <param name="name">h_name</param>
    <param name="label">Host</param>
    <param name="postProcess">search h_region="$h_region$" h_building="$h_building$" | sort h_name | dedup h_name</param>
    <param name="separator">+OR+</param>
    <param name="staticFieldsToDisplay">
  <list>
    <param name="label">All</param>
    <param name="value">*</param>
      </list>
     </param>
    <param name="searchFieldsToDisplay">
      <list>

        <param name="label">h_name</param>
        <param name="value">h_name</param>

      </list>
    </param>



  </module>
  </module>
</module>



1 Solution

sideview
SplunkTrust
SplunkTrust

Great question. Sorry I haven't answered it until now, but I've been quietly chewing on it.

I can treat this as a bug and have it fixed in a future release. It's a somewhat interesting issue, and how to fix the issue without introducing a bunch more issues is also interesting, but any writeup I've tried of it sounds terribly dull and pedantic so I'll spare you.

To be very brief, a Pulldown selecting itself to "" amounts to selecting itself to a null value, having seen a null value from upstream. However there are in general always null values from upstream therefore selecting itself to All/"" like this would result in it constantly resetting itself to All/"" which would be obviously annoying. Hm. OK that was less pedantic.

I'm afraid for now there's no workaround, but I'll try and get it fixed in the next release.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Great question. Sorry I haven't answered it until now, but I've been quietly chewing on it.

I can treat this as a bug and have it fixed in a future release. It's a somewhat interesting issue, and how to fix the issue without introducing a bunch more issues is also interesting, but any writeup I've tried of it sounds terribly dull and pedantic so I'll spare you.

To be very brief, a Pulldown selecting itself to "" amounts to selecting itself to a null value, having seen a null value from upstream. However there are in general always null values from upstream therefore selecting itself to All/"" like this would result in it constantly resetting itself to All/"" which would be obviously annoying. Hm. OK that was less pedantic.

I'm afraid for now there's no workaround, but I'll try and get it fixed in the next release.

sideview
SplunkTrust
SplunkTrust

This was fixed as a bug and the general behavior of multiselect Pulldowns that do have an "all/*" entry was improved at some point in Sideview Utils 2.X. It seems to have not made it into the release notes but it did happen.

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...