Dashboards & Visualizations

Dynamic dropdown select All from dropdown list only

Explorer

I currently have a dropdown that is working properly but I want to add an All selection and make it default. The problem I am running into is either it will select all items in the inputlookup or it will return nothing.

XML for working dropdown:

  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="ProjectName" searchWhenChanged="true">
      <label>Project Name</label>
      <fieldForLabel>PROJ_NAME</fieldForLabel>
      <fieldForValue>PROJ_NAME</fieldForValue>
      <search>
        <query>| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>

This will create a dropdown like:

Project ABC
Project DEF
Project XYZ

And yes there are spaces in the output.

I have tried something like this:

  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="ProjectName" searchWhenChanged="true">
      <label>Project Name</label>
      <fieldForLabel>PROJ_NAME</fieldForLabel>
      <fieldForValue>PROJ_NAME</fieldForValue>
      <search>
        <query>| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
        <choice value="*">All Projects</choice>
          <default>*</default>
          <initialValue>*</initialValue>
    </input>
  </fieldset>

But this returns ALL ProjectCodes and is not limiting it to 99*

I also tried the following:

  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="ProjectName" searchWhenChanged="true">
      <label>Project Name</label>
      <fieldForLabel>PROJ_NAME</fieldForLabel>
      <fieldForValue>PROJ_NAME</fieldForValue>
      <search>
        <query>| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
       <choice value="all_projects">All Projects</choice>
       <change>
         <condition value="all_projects">
           <set token="queryFilter">[| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME]</set>
         </condition>
         <condition>
           <set token="queryFilter">PROJ_NAME="$value$"</set>
         </condition>
       </change>
    </input>
  </fieldset>

This just returns nothing.

Any help would be greatly appreciated.

0 Karma

Contributor
| inputlookup assets.csv | return ProjectCode | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode

Try this and also you can also try without the table part in your query. You don't have to use the table in a dropdown search.
Hope this helps. Thanks for the question.

0 Karma

New Member

After looking into network logs in browser I figured it out like sort command is truncating the results to 10000 rows. May be I should avoid it as dropdown already having the filter option (autocomplete).

messages: [{type: "INFO", text: "The sort command is truncating output to 10000 rows"}]
preview: false
results: [{env_name: "mlcd1", count: "1"}, {env_name: "mlcd2", count: "1"}, {env_name: "mlct1", count: "1"},…]
0: {env_name: "mlcd1", count: "1"}
1: {env_name: "mlcd2", count: "1"}
2: {env_name: "mlct1", count: "1"}
3: {env_name: "mlct2", count: "1"}
4: {env_name: "np1", count: "1"}
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!