Dashboards & Visualizations

How to exclude specific option from all option in dynamic drop-down?

juvenile
Loves-to-Learn
<input id="select_abc" type="multiselect" token="token_abc" searchWhenChanged="true">
    <label>ABC&#8205;</label>

    <default>*</default>

    <prefix>(</prefix>
    <suffix>)</suffix>
    <valuePrefix>"</valuePrefix>
    <valueSuffix>"</valueSuffix>

    <choice value="*">All</choice>
    <search base="base_search">
        <query>
            | stats count as count by some_field
            | sort 0 - count
        </query>
    </search>
    <fieldForLabel>some_field</fieldForLabel>
    <fieldForValue>some_field</fieldForValue>

    <delimiter>,</delimiter>

    <change>
        <condition label="All">
            <set token="token_abc">("*") AND some_field != "SomeArbitraryStringValue"</set>
        </condition>
    </change>
</input>

I was wondering how I can exclude a specific option from the asterisk (*) value of the "All" option? Also, how does it work with parantheses and also exlcuding it from the default value?

Thank you

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @juvenile ,

create a more complicated value for All, e.g. if you want to exclude events with some_field="xxx":

<input id="select_abc" type="multiselect" token="token_abc" searchWhenChanged="true">
    <label>ABC&#8205;</label>

    <default>*</default>
    <prefix>(</prefix>
    <suffix>)</suffix>
    <choice value=* AND NOT some_field="SomeArbitraryStringValue">All</choice>
    <search base="base_search">
        <query>
            | stats count as count by some_field
            | sort 0 - count
        </query>
    </search>
    <fieldForLabel>some_field</fieldForLabel>
    <fieldForValue>some_field</fieldForValue>
</input>

Please adapt this solution to your requirements.

Ciao.

Giuseppe

0 Karma

juvenile
Loves-to-Learn

Hi @gcusello , thank you for your answer. What about the default value?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @juvenile ,

as you like: the same of All or one of the dinamic values.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...