Hi Everyone,
I have a multi-select In my Dashboard and it is working fine. However I want to add a default option ="All" which will display all the results and not filter results based on multi-select option. Please help me to set up a default option when the Dashboard is loaded Initially.
PFB the Source Code I am working on:
<form>
<label>TechPivot_WF</label>
<description>This Dashboard gives Run-Time Statistics at a WorkFlow Level</description>
<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="WFName" searchWhenChanged="true">
<label>Select WorkFlow</label>
<prefix>(</prefix>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter>,</delimiter>
<suffix>)</suffix>
<fieldForLabel>WorkFlowName</fieldForLabel>
<fieldForValue>WorkFlowName</fieldForValue>
<search>
<query>source="Splunkv1.log" sourcetype="TechPivitv1" |stats count by WorkFlowName</query>
<earliest>0</earliest>
<latest></latest>
</search>
</input>
<input type="time" token="tok_time" searchWhenChanged="true">
<label>Select Time Range</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>Work Flow Statistics</title>
<chart>
<title>Runtime Statistics</title>
<searchString>source="Splunkv1.log" sourcetype="TechPivitv1" | where WorkFlowName in $WFName$ | timechart avg(Duration) by WorkFlowName useother=false
</searchString>
<earliestTime>$tok_time.earliest$</earliestTime>
<latestTime>$tok_time.latest$</latestTime>
<option name="charting.axisTitleX.text">Event Time</option>
<option name="charting.axisTitleY.text">Average Duration (in mins)</option>
<option name="charting.chart">column</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">top</option>
</chart>
</panel>
</row>
</form>
Try to add a static value to the input called All with value * and set that to default.
<default>All</default>
<choice value=*>All</choice>
Try to add a static value to the input called All with value * and set that to default.
<default>All</default>
<choice value=*>All</choice>
Hi..How do I modify my search string to display the results i.e. when All is selected- I want to eliminate the where clause of the below search string and display the results.
source="Splunkv1.log" sourcetype="TechPivitv1" | where WorkFlowName in $WFName$ | timechart avg(Duration) by WorkFlowName useother=false </>
Instead of the where statement, try this:
Change the valuePrefix to WorkFlowName="
, valueSuffix to "
and the delimiter to OR
Then use the token in your base search.
source="Splunkv1.log" sourcetype="TechPivitv1" $WFName$| timechart avg(Duration) by WorkFlowName useother=false
This worked..
Thank you so much for the help