Dashboards & Visualizations

Default Option for Multi-select in Dashboard

snehasal
Explorer

Hi Everyone,

I have a multi-select In my Dashboard and it is working fine. However I want to add a default option ="All" which will display all the results and not filter results based on multi-select option. Please help me to set up a default option when the Dashboard is loaded Initially.
PFB the Source Code I am working on:

<form>
  <label>TechPivot_WF</label>
  <description>This Dashboard gives Run-Time Statistics at a WorkFlow Level</description>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="WFName" searchWhenChanged="true">
      <label>Select WorkFlow</label>
      <prefix>(</prefix>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>,</delimiter>
      <suffix>)</suffix>
      <fieldForLabel>WorkFlowName</fieldForLabel>
      <fieldForValue>WorkFlowName</fieldForValue>
      <search>
        <query>source="Splunkv1.log" sourcetype="TechPivitv1" |stats count by WorkFlowName</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
    </input>
    <input type="time" token="tok_time" searchWhenChanged="true">
      <label>Select Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Work Flow Statistics</title>
      <chart>
        <title>Runtime Statistics</title>
        <searchString>source="Splunkv1.log" sourcetype="TechPivitv1"  | where WorkFlowName in $WFName$ | timechart  avg(Duration) by WorkFlowName useother=false
        </searchString>
        <earliestTime>$tok_time.earliest$</earliestTime>
        <latestTime>$tok_time.latest$</latestTime>
        <option name="charting.axisTitleX.text">Event Time</option>
        <option name="charting.axisTitleY.text">Average Duration (in mins)</option>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">top</option>
      </chart>
    </panel>
  </row>
</form>
Tags (2)
1 Solution

cmerriman
Super Champion

Try to add a static value to the input called All with value * and set that to default.

  <default>All</default>
   <choice value=*>All</choice>

View solution in original post

cmerriman
Super Champion

Try to add a static value to the input called All with value * and set that to default.

  <default>All</default>
   <choice value=*>All</choice>

snehasal
Explorer

Hi..How do I modify my search string to display the results i.e. when All is selected- I want to eliminate the where clause of the below search string and display the results.

source="Splunkv1.log" sourcetype="TechPivitv1" | where WorkFlowName in $WFName$ | timechart avg(Duration) by WorkFlowName useother=false </>

0 Karma

cmerriman
Super Champion

Instead of the where statement, try this:

Change the valuePrefix to WorkFlowName=", valueSuffix to " and the delimiter to OR

Then use the token in your base search.
source="Splunkv1.log" sourcetype="TechPivitv1" $WFName$| timechart avg(Duration) by WorkFlowName useother=false

0 Karma

snehasal
Explorer

This worked..
Thank you so much for the help

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...