selecting all the values in the Pulldown multiselect by default in splunk (sideview utils)

[JaideepK]

I am using sideview Utils Pulldown multiselect how can select all the values in the pulldown by deafult?

[sideview · Accepted solution]

Actually the best advice I can give, is to use the CheckboxPulldown module which came out back in Sideview Utils 3.2.

1) CheckboxPulldown is so much better and more useful of a control than the multiselect Pulldown that I consider the multiselect Pulldown to be obsolete.

2) CheckboxPulldown actually selects everything by default.

---

There is a weird and crazy workaround that I've seen though, and I mean very weird. First, don't actually do this - use CheckboxPulldown. 😃 But I mention it cause it's fun. Stitch a sequence of other modules just upstream of that Pulldown. Say that the name param of your Pulldown module is foo

1) PostProcess to do | stats list(foo) as foo | eval foo=mvjoin(foo,"::"), ie giving you a big string of all the values separated by ::

2) ResultsValueSetter to pull $foo$ down as a token,

3) ValueSetter with <param name="name">foo</param>, <param name="value">$foo$</param> and <param name="delim">::</param>

Coming out of the ValueSetter is an array-valued foo token that has the same name as the Pulldown and that just happens to have every value in that Pulldown. the multiselect Pulldown module will see that array valued token and set it's own selection to it's values. Thus all become selected.

But again.... don't do that. Just use CheckboxPulldown. It's way better and selects all options by default.

[nabeel652]

In checkboxpulldown module how to deselect all values by default?

[JaideepK]

Thanks a lot... The CheckboxPulldown worked but the workaround didn't worked for me