Dashboards & Visualizations

How do I make a multiselect dashboard input pretty when multiple default values are provided by a token?

ruman_splunk
Splunk Employee
Splunk Employee

Hi! I have a dashboard with a multiselect input. Let's pretend it has 3 choices

<input type="multiselect" token="foo">
  <label>bar</label>
  <choice value="1">One</choice>
  <choice value="2">Two</choice>
  <choice value="3">Three</choice>

If I set a default with multiple values, the UI is very pretty

<default>1,2</default> <!-- UI shows "[One] [Two]". Each label is in its own box, very pretty! -->

But if I set a token that contains the same string and use that as the default, the UI shows values instead of labels, which is ugly!

<init><set token="foo_default">1,2</set></init>
...
<default>$foo_default$</default> <!-- UI shows "[1,2]" - only one box, and no labels, ugly, hard to read. -->

How do I get the multiselect UI to render labels when I am supplying multiple default values with a token?

Setting depends="$foo_default$" on the input does not help.

Setting a single default value with a token works as expected.

0 Karma
1 Solution

ruman_splunk
Splunk Employee
Splunk Employee

I've discovered two workarounds for this:

  1. More generically: create the input in JS using the webframework. You can set a default with multiple values programatically in JS.

    require([
    "splunkjs/mvc/searchmanager",
    "splunkjs/mvc/multidropdownview",
    "splunkjs/mvc/simplexml/ready!"
    ], function(
    SearchManager,
    MultiDropdownView
    ) {
    var foo = new MultiDropdownView({
    id: "foo",
    choices: [
    {label:"One", value: "1"},
    {label:"Two", value: "2"},
    {label:"Three", value: "3"}],
    el: $("#foo")
    }).render();
    foo.settings.set("default", [1, 2]);
    });

  2. If (as I do) you have two sets of default options that you're choosing between, create two inputs in SimpleXML identical except for the (inline) default values and show only one of them depending on which set of defaults should be shown.

jbillings
Path Finder

"I want to fire an event when the token is set, and update the value of the multiselect, but there doesn't seem to be any way to do that that I can figure out..."

You can pass a token to a search string in your multiselect. It won't set the default, but it will update the available values for the multiselect.

   </input>
<input type="multiselect" token="attack_type">
  <label>Attack Type</label>
  <choice value="*">All</choice>
  <default>*</default>
  <initialValue>*</initialValue>
  <fieldForLabel>attack_type</fieldForLabel>
  <fieldForValue>attack_type</fieldForValue>
  <search>
    <query>index=attack sourcetype=attack:syslog eventtype=attack $policy_name$

| stats count by attack_type
$time.earliest$
$time.latest$

attack_type="
"
OR

0 Karma

ruman_splunk
Splunk Employee
Splunk Employee

I'm interested here in setting the default value from a token, not setting the options themselves, but thank you!

0 Karma

ruman_splunk
Splunk Employee
Splunk Employee

It feels like there's something that the UI does when there's an inline default, that gets skipped when the default comes from a token (maybe because the token gets set after the multiselect input initializes)

In which case, I'm looking for some way to kick the input so that it reprocesses the default. I wonder if instead of setting a default, I want to fire an event when the token is set, and update the value of the multiselect, but there doesn't seem to be any way to do that that I can figure out...

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...