Dashboards & Visualizations

How to covert multiselect to Drop down with option of "All" values

aditsss
Motivator

Hi Everyone,

I have one requirement . I have one multiselect like below:

<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<choice value="*">All Salesforce Org</choice>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | stats count by OrgName</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>OrgName</fieldForValue>
<prefix>(</prefix>
<valuePrefix>OrgName ="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
<initialValue>*</initialValue>
<default>*</default>
</input>

My requirement is I want to convert it into drop down . So I converted with below code:

<input type="dropdown" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<choice value="*">All Salesforce Org</choice>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | stats count by OrgName</query>
</search>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>OrgName</fieldForValue>
<prefix>OrgName="</prefix>
<suffix>"</suffix>
<initialValue>OneForce</initialValue>
<default>OneForce</default>
</input>

This is working fine but what I want is " All Salesforce Org" value should come at end.

Can someone guide me.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

As I said "If it doesn't you could try appending a result to query to represent the all option you want."

 <input type="dropdown" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | dedup OrgName | eval Value=OrgName | append [| makeresults | eval OrgName="All Salesforce Org" | eval Value="*" ]</query>
</search>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>Value</fieldForValue>
<prefix>OrgName="</prefix>
<suffix>"</suffix>
<initialValue>OneForce</initialValue>
<default>OneForce</default>
</input> 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try moving the choice to after the search

<input type="dropdown" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | stats count by OrgName</query>
</search>
<choice value="*">All Salesforce Org</choice>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>OrgName</fieldForValue>
<prefix>OrgName="</prefix>
<suffix>"</suffix>
<initialValue>OneForce</initialValue>
<default>OneForce</default>
</input>
0 Karma

aditsss
Motivator

@ITWhisperer 

I have done like this but still "All Salesforce Org" is coming at the top.

I have made "OneForce" as default and initial and I want " All Salesforce Org" should come at the end.

<input type="dropdown" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | stats count by OrgName</query>
</search>
<choice value="*">All Salesforce Org</choice>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>OrgName</fieldForValue>
<prefix>OrgName="</prefix>
<suffix>"</suffix>
<initialValue>OneForce</initialValue>
<default>OneForce</default>
</input>

Attached is the screenshot for the same.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Looks like they are in alphabetical order - try reversing the order returned by the query and see if it gets re-ordered back to alphabetical. If it doesn't you could try appending a result to query to represent the all option you want.

0 Karma

aditsss
Motivator

@ITWhisperer 

"All Salesforce Org" is coming before Accertify. 

All the values in drop down are  different different Orgs and their is one common option that is "All Salesforce Org" .

How can I put it at the end.

 <input type="dropdown" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | stats count by OrgName</query>
</search>
<choice value="*">All Salesforce Org</choice>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>OrgName</fieldForValue>
<prefix>OrgName="</prefix>
<suffix>"</suffix>
<initialValue>OneForce</initialValue>
<default>OneForce</default>
</input> 

How can I reverse . Please guide.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As I said "If it doesn't you could try appending a result to query to represent the all option you want."

 <input type="dropdown" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | dedup OrgName | eval Value=OrgName | append [| makeresults | eval OrgName="All Salesforce Org" | eval Value="*" ]</query>
</search>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>Value</fieldForValue>
<prefix>OrgName="</prefix>
<suffix>"</suffix>
<initialValue>OneForce</initialValue>
<default>OneForce</default>
</input> 

aditsss
Motivator

@ITWhisperer

you are best as always thank you.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...