Dashboards & Visualizations

Default Option for Multi-select in Dashboard

snehasal
Explorer

Hi Everyone,

I have a multi-select In my Dashboard and it is working fine. However I want to add a default option ="All" which will display all the results and not filter results based on multi-select option. Please help me to set up a default option when the Dashboard is loaded Initially.
PFB the Source Code I am working on:

<form>
  <label>TechPivot_WF</label>
  <description>This Dashboard gives Run-Time Statistics at a WorkFlow Level</description>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="WFName" searchWhenChanged="true">
      <label>Select WorkFlow</label>
      <prefix>(</prefix>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>,</delimiter>
      <suffix>)</suffix>
      <fieldForLabel>WorkFlowName</fieldForLabel>
      <fieldForValue>WorkFlowName</fieldForValue>
      <search>
        <query>source="Splunkv1.log" sourcetype="TechPivitv1" |stats count by WorkFlowName</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
    </input>
    <input type="time" token="tok_time" searchWhenChanged="true">
      <label>Select Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Work Flow Statistics</title>
      <chart>
        <title>Runtime Statistics</title>
        <searchString>source="Splunkv1.log" sourcetype="TechPivitv1"  | where WorkFlowName in $WFName$ | timechart  avg(Duration) by WorkFlowName useother=false
        </searchString>
        <earliestTime>$tok_time.earliest$</earliestTime>
        <latestTime>$tok_time.latest$</latestTime>
        <option name="charting.axisTitleX.text">Event Time</option>
        <option name="charting.axisTitleY.text">Average Duration (in mins)</option>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">top</option>
      </chart>
    </panel>
  </row>
</form>
Tags (2)
1 Solution

cmerriman
Super Champion

Try to add a static value to the input called All with value * and set that to default.

  <default>All</default>
   <choice value=*>All</choice>

View solution in original post

cmerriman
Super Champion

Try to add a static value to the input called All with value * and set that to default.

  <default>All</default>
   <choice value=*>All</choice>

snehasal
Explorer

Hi..How do I modify my search string to display the results i.e. when All is selected- I want to eliminate the where clause of the below search string and display the results.

source="Splunkv1.log" sourcetype="TechPivitv1" | where WorkFlowName in $WFName$ | timechart avg(Duration) by WorkFlowName useother=false </>

0 Karma

cmerriman
Super Champion

Instead of the where statement, try this:

Change the valuePrefix to WorkFlowName=", valueSuffix to " and the delimiter to OR

Then use the token in your base search.
source="Splunkv1.log" sourcetype="TechPivitv1" $WFName$| timechart avg(Duration) by WorkFlowName useother=false

0 Karma

snehasal
Explorer

This worked..
Thank you so much for the help

0 Karma
Get Updates on the Splunk Community!

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...