Dashboards & Visualizations

Default Option for Multi-select in Dashboard

Explorer

Hi Everyone,

I have a multi-select In my Dashboard and it is working fine. However I want to add a default option ="All" which will display all the results and not filter results based on multi-select option. Please help me to set up a default option when the Dashboard is loaded Initially.
PFB the Source Code I am working on:

<form>
  <label>TechPivot_WF</label>
  <description>This Dashboard gives Run-Time Statistics at a WorkFlow Level</description>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="WFName" searchWhenChanged="true">
      <label>Select WorkFlow</label>
      <prefix>(</prefix>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>,</delimiter>
      <suffix>)</suffix>
      <fieldForLabel>WorkFlowName</fieldForLabel>
      <fieldForValue>WorkFlowName</fieldForValue>
      <search>
        <query>source="Splunkv1.log" sourcetype="TechPivitv1" |stats count by WorkFlowName</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
    </input>
    <input type="time" token="tok_time" searchWhenChanged="true">
      <label>Select Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Work Flow Statistics</title>
      <chart>
        <title>Runtime Statistics</title>
        <searchString>source="Splunkv1.log" sourcetype="TechPivitv1"  | where WorkFlowName in $WFName$ | timechart  avg(Duration) by WorkFlowName useother=false
        </searchString>
        <earliestTime>$tok_time.earliest$</earliestTime>
        <latestTime>$tok_time.latest$</latestTime>
        <option name="charting.axisTitleX.text">Event Time</option>
        <option name="charting.axisTitleY.text">Average Duration (in mins)</option>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">top</option>
      </chart>
    </panel>
  </row>
</form>
Tags (2)
1 Solution

Super Champion

Try to add a static value to the input called All with value * and set that to default.

  <default>All</default>
   <choice value=*>All</choice>

View solution in original post

Super Champion

Try to add a static value to the input called All with value * and set that to default.

  <default>All</default>
   <choice value=*>All</choice>

View solution in original post

Explorer

Hi..How do I modify my search string to display the results i.e. when All is selected- I want to eliminate the where clause of the below search string and display the results.

source="Splunkv1.log" sourcetype="TechPivitv1" | where WorkFlowName in $WFName$ | timechart avg(Duration) by WorkFlowName useother=false </>

0 Karma

Super Champion

Instead of the where statement, try this:

Change the valuePrefix to WorkFlowName=", valueSuffix to " and the delimiter to OR

Then use the token in your base search.
source="Splunkv1.log" sourcetype="TechPivitv1" $WFName$| timechart avg(Duration) by WorkFlowName useother=false

0 Karma

Explorer

This worked..
Thank you so much for the help

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!