Dashboards & Visualizations

Default Option for Multi-select in Dashboard

snehasal
Explorer

Hi Everyone,

I have a multi-select In my Dashboard and it is working fine. However I want to add a default option ="All" which will display all the results and not filter results based on multi-select option. Please help me to set up a default option when the Dashboard is loaded Initially.
PFB the Source Code I am working on:

<form>
  <label>TechPivot_WF</label>
  <description>This Dashboard gives Run-Time Statistics at a WorkFlow Level</description>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="WFName" searchWhenChanged="true">
      <label>Select WorkFlow</label>
      <prefix>(</prefix>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>,</delimiter>
      <suffix>)</suffix>
      <fieldForLabel>WorkFlowName</fieldForLabel>
      <fieldForValue>WorkFlowName</fieldForValue>
      <search>
        <query>source="Splunkv1.log" sourcetype="TechPivitv1" |stats count by WorkFlowName</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
    </input>
    <input type="time" token="tok_time" searchWhenChanged="true">
      <label>Select Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Work Flow Statistics</title>
      <chart>
        <title>Runtime Statistics</title>
        <searchString>source="Splunkv1.log" sourcetype="TechPivitv1"  | where WorkFlowName in $WFName$ | timechart  avg(Duration) by WorkFlowName useother=false
        </searchString>
        <earliestTime>$tok_time.earliest$</earliestTime>
        <latestTime>$tok_time.latest$</latestTime>
        <option name="charting.axisTitleX.text">Event Time</option>
        <option name="charting.axisTitleY.text">Average Duration (in mins)</option>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">top</option>
      </chart>
    </panel>
  </row>
</form>
Tags (2)
1 Solution

cmerriman
Super Champion

Try to add a static value to the input called All with value * and set that to default.

  <default>All</default>
   <choice value=*>All</choice>

View solution in original post

cmerriman
Super Champion

Try to add a static value to the input called All with value * and set that to default.

  <default>All</default>
   <choice value=*>All</choice>

snehasal
Explorer

Hi..How do I modify my search string to display the results i.e. when All is selected- I want to eliminate the where clause of the below search string and display the results.

source="Splunkv1.log" sourcetype="TechPivitv1" | where WorkFlowName in $WFName$ | timechart avg(Duration) by WorkFlowName useother=false </>

0 Karma

cmerriman
Super Champion

Instead of the where statement, try this:

Change the valuePrefix to WorkFlowName=", valueSuffix to " and the delimiter to OR

Then use the token in your base search.
source="Splunkv1.log" sourcetype="TechPivitv1" $WFName$| timechart avg(Duration) by WorkFlowName useother=false

0 Karma

snehasal
Explorer

This worked..
Thank you so much for the help

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...