Dashboards & Visualizations

How to covert multiselect to Drop down with option of "All" values

aditsss
Motivator

Hi Everyone,

I have one requirement . I have one multiselect like below:

<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<choice value="*">All Salesforce Org</choice>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | stats count by OrgName</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>OrgName</fieldForValue>
<prefix>(</prefix>
<valuePrefix>OrgName ="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
<initialValue>*</initialValue>
<default>*</default>
</input>

My requirement is I want to convert it into drop down . So I converted with below code:

<input type="dropdown" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<choice value="*">All Salesforce Org</choice>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | stats count by OrgName</query>
</search>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>OrgName</fieldForValue>
<prefix>OrgName="</prefix>
<suffix>"</suffix>
<initialValue>OneForce</initialValue>
<default>OneForce</default>
</input>

This is working fine but what I want is " All Salesforce Org" value should come at end.

Can someone guide me.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

As I said "If it doesn't you could try appending a result to query to represent the all option you want."

 <input type="dropdown" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | dedup OrgName | eval Value=OrgName | append [| makeresults | eval OrgName="All Salesforce Org" | eval Value="*" ]</query>
</search>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>Value</fieldForValue>
<prefix>OrgName="</prefix>
<suffix>"</suffix>
<initialValue>OneForce</initialValue>
<default>OneForce</default>
</input> 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try moving the choice to after the search

<input type="dropdown" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | stats count by OrgName</query>
</search>
<choice value="*">All Salesforce Org</choice>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>OrgName</fieldForValue>
<prefix>OrgName="</prefix>
<suffix>"</suffix>
<initialValue>OneForce</initialValue>
<default>OneForce</default>
</input>
0 Karma

aditsss
Motivator

@ITWhisperer 

I have done like this but still "All Salesforce Org" is coming at the top.

I have made "OneForce" as default and initial and I want " All Salesforce Org" should come at the end.

<input type="dropdown" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | stats count by OrgName</query>
</search>
<choice value="*">All Salesforce Org</choice>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>OrgName</fieldForValue>
<prefix>OrgName="</prefix>
<suffix>"</suffix>
<initialValue>OneForce</initialValue>
<default>OneForce</default>
</input>

Attached is the screenshot for the same.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Looks like they are in alphabetical order - try reversing the order returned by the query and see if it gets re-ordered back to alphabetical. If it doesn't you could try appending a result to query to represent the all option you want.

0 Karma

aditsss
Motivator

@ITWhisperer 

"All Salesforce Org" is coming before Accertify. 

All the values in drop down are  different different Orgs and their is one common option that is "All Salesforce Org" .

How can I put it at the end.

 <input type="dropdown" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | stats count by OrgName</query>
</search>
<choice value="*">All Salesforce Org</choice>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>OrgName</fieldForValue>
<prefix>OrgName="</prefix>
<suffix>"</suffix>
<initialValue>OneForce</initialValue>
<default>OneForce</default>
</input> 

How can I reverse . Please guide.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As I said "If it doesn't you could try appending a result to query to represent the all option you want."

 <input type="dropdown" token="OrgName" searchWhenChanged="true">
<label>Salesforce Org Name</label>
<search>
<query>index="abc" sourcetype="xyz" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | dedup OrgName | eval Value=OrgName | append [| makeresults | eval OrgName="All Salesforce Org" | eval Value="*" ]</query>
</search>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>Value</fieldForValue>
<prefix>OrgName="</prefix>
<suffix>"</suffix>
<initialValue>OneForce</initialValue>
<default>OneForce</default>
</input> 

aditsss
Motivator

@ITWhisperer

you are best as always thank you.

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...