Dashboards & Visualizations

How to covert multiselect to Drop down with option of "All" values

aditsss
Motivator

Hi Everyone,

I have one requirement . I have one multiselect like below:

<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<choice value="*">All Salesforce Org</choice>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | stats count by OrgName</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>OrgName</fieldForValue>
<prefix>(</prefix>
<valuePrefix>OrgName ="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
<initialValue>*</initialValue>
<default>*</default>
</input>

My requirement is I want to convert it into drop down . So I converted with below code:

<input type="dropdown" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<choice value="*">All Salesforce Org</choice>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | stats count by OrgName</query>
</search>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>OrgName</fieldForValue>
<prefix>OrgName="</prefix>
<suffix>"</suffix>
<initialValue>OneForce</initialValue>
<default>OneForce</default>
</input>

This is working fine but what I want is " All Salesforce Org" value should come at end.

Can someone guide me.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

As I said "If it doesn't you could try appending a result to query to represent the all option you want."

 <input type="dropdown" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | dedup OrgName | eval Value=OrgName | append [| makeresults | eval OrgName="All Salesforce Org" | eval Value="*" ]</query>
</search>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>Value</fieldForValue>
<prefix>OrgName="</prefix>
<suffix>"</suffix>
<initialValue>OneForce</initialValue>
<default>OneForce</default>
</input> 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try moving the choice to after the search

<input type="dropdown" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | stats count by OrgName</query>
</search>
<choice value="*">All Salesforce Org</choice>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>OrgName</fieldForValue>
<prefix>OrgName="</prefix>
<suffix>"</suffix>
<initialValue>OneForce</initialValue>
<default>OneForce</default>
</input>
0 Karma

aditsss
Motivator

@ITWhisperer 

I have done like this but still "All Salesforce Org" is coming at the top.

I have made "OneForce" as default and initial and I want " All Salesforce Org" should come at the end.

<input type="dropdown" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | stats count by OrgName</query>
</search>
<choice value="*">All Salesforce Org</choice>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>OrgName</fieldForValue>
<prefix>OrgName="</prefix>
<suffix>"</suffix>
<initialValue>OneForce</initialValue>
<default>OneForce</default>
</input>

Attached is the screenshot for the same.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Looks like they are in alphabetical order - try reversing the order returned by the query and see if it gets re-ordered back to alphabetical. If it doesn't you could try appending a result to query to represent the all option you want.

0 Karma

aditsss
Motivator

@ITWhisperer 

"All Salesforce Org" is coming before Accertify. 

All the values in drop down are  different different Orgs and their is one common option that is "All Salesforce Org" .

How can I put it at the end.

 <input type="dropdown" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | stats count by OrgName</query>
</search>
<choice value="*">All Salesforce Org</choice>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>OrgName</fieldForValue>
<prefix>OrgName="</prefix>
<suffix>"</suffix>
<initialValue>OneForce</initialValue>
<default>OneForce</default>
</input> 

How can I reverse . Please guide.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As I said "If it doesn't you could try appending a result to query to represent the all option you want."

 <input type="dropdown" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | dedup OrgName | eval Value=OrgName | append [| makeresults | eval OrgName="All Salesforce Org" | eval Value="*" ]</query>
</search>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>Value</fieldForValue>
<prefix>OrgName="</prefix>
<suffix>"</suffix>
<initialValue>OneForce</initialValue>
<default>OneForce</default>
</input> 

aditsss
Motivator

@ITWhisperer

you are best as always thank you.

0 Karma
Get Updates on the Splunk Community!

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...