Dashboards & Visualizations

How to get rid of default "All" from Multiselect filter having hardcoded values?

garima_13
Engager

Hi,

I am working on a multiselect filter, where default "All" option should be removed
if the user selects something other than "All". The caviat is that the options for multiselect are
not based on a search, they are manually added. For example:

 

<choice value="first_choice=&quot;*&quot;">All</choice>
<choice value="second_choice=&quot;Y&quot;">second choice</choice>
<choice value="third_choice=&quot;Y&quot;">third choice</choice>
<choice value="fourth_choice=&quot;Y&quot;">fourth choice</choice>
<choice value="fifth_choice=&quot;Y&quot;">fifth choice</choice>

 

What I usually do doesn't work:

 

<change>
<eval token="form.mytoken">if(mvcount('form.mytoken')=0,"*",if(mvcount('form.mytoken')!=1,mvfilter('form.mytoken'!="*"),'form.mytoken'))</eval>
</change>

 

If anyone has a solution, I would really appreciate it. Thank you!

Labels (4)
0 Karma

Anujin
Loves-to-Learn
"clearDefaultOnSelection"true
 
 
0 Karma

woodcock
Esteemed Legend

Just cheat like this:

<input type="multiselect" token="hard_coded_list">
<label>hardcoded list</label>
<fieldForLabel>label</fieldForLabel>
<fieldForValue>value</fieldForValue>
<search>
<query>| makeresults | eval _raw="
value         label
*             All
second choice second choice
third_choice  third choice
fourth_choice fourth choice
fifth_choice  fifth choice"
| multikv forceheader=1</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<change>
<eval token="form.hard_coded_list">case(mvcount($form.hard_coded_list$) == 2 AND mvindex($form.hard_coded_list$, 0) == "*", mvindex($form.hard_coded_list$, 1), mvfind($form.hard_coded_list$, "^\\*$") == mvcount($form.hard_coded_list$) - 1, "*", true(), $form.hard_coded_list$, false(), "BEWARE: THIS INPUT MUST NOT CONTAIN THE 'searchWhenChanged' FLAG!!!")</eval>
</change>
<default>*</default>
<prefix>sourcetype IN(</prefix>
<suffix>)</suffix>
<initialValue>*</initialValue>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter>,</delimiter>
</input>



0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Three things need to happen relating to "All" - if the selection is empty, put the default "All" in the form token; if "All" is added after another value, make the form token hold just "All"; and, if another value is added after "All", keep all values which aren't "All". Otherwise, keep the token as it is.

        <change>
          <eval token="form.mytoken">case(mvcount('form.mytoken')=0,"All",mvcount('form.mytoken')&gt;1 AND mvfind('form.mytoken',"All")&gt;0,"All",mvcount('form.mytoken')&gt;1 AND mvfind('form.mytoken',"All")=0,mvfilter('form.mytoken'!="All"),1==1,'form.mytoken')</eval>
        </change>

Note that the case function has to be all on one line in the dashboard code.

0 Karma

yuliyavas
Observer

Hi,

Here with the same issue. When you mention "All" in the xml, you are not using the value "first_choice=&quot;*&quot;" ?

<choice value="first_choice=&quot;*&quot;">All</choice>

this is a default and initial value, where first_choice is an actual field in the search. the rest of the choices are also fields in the search.  I'd expect to be using that. Here is an example

       <eval token="form.mytoken">case(mvcount('form.mytoken')=0,"first_choice=&quot;*&quot;",mvcount('form.mytoken')&gt;1 AND mvfind('form.mytoken',"first_choice=&quot;*&quot;")&gt;0,"first_choice=&quot;*&quot;",mvcount('form.mytoken')&gt;1 AND mvfind('form.mytoken',"first_choice=&quot;*&quot;")=0,mvfilter('form.mytoken'!="first_choice=&quot;*&quot;"),1==1,'form.mytoken')</eval>

But please correct me if that's not the case. I am trying to use the logic that you are showing here, and it makes sense, but it doesn't work with my example-the "ALL" option is still there even if i pick something else. 

 

 

 Thank you for helping out.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try escaping the double quotes with backslash in the strings

<form version="1.1">
  <label>Multiselect</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="alloptions" searchWhenChanged="true">
      <label>Options ($optioncount$) $alloptions$</label>
      <choice value="first_choice=&quot;*&quot;">All</choice>
      <choice value="second_choice=&quot;Y&quot;">second choice</choice>
      <choice value="third_choice=&quot;Y&quot;">third choice</choice>
      <choice value="fourth_choice=&quot;Y&quot;">fourth choice</choice>
      <choice value="fifth_choice=&quot;Y&quot;">fifth choice</choice>
      <delimiter>,</delimiter>
      <change>
        <eval token="optioncount">mvcount('form.alloptions')</eval>
        <eval token="form.alloptions">case(mvcount('form.alloptions')=0,"first_choice=\"*\"",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"first_choice=\"*\"")&gt;0,"first_choice=\"*\"",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"first_choice=\"*\"")=0,mvfilter('form.alloptions'!="first_choice=\"*\""),1==1,'form.alloptions')</eval>
      </change>
    </input>
  </fieldset>
</form>
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Be aware that <change> it not supported on multiselect inputs though and I vaguely remember finding a case where it didn't work, though lost in the depths of time

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are you sure about that, because I use this type of code with multiselect inputs in 8.2.2.1 and 9.0.4

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Sure? No - not really other than that the docs state that in the inputs section

https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#input_.28form...

and some time ago I did have some particular use case, where some aspect of <change> did not work as expected, but for the life of me, I can't recall the exact behaviour and whether it was change+condition or something else.

So, I just started relying on the JS solution, as that works.

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this (ignore documentation in this instance 😁)

<form version="1.1">
  <label>Multiselect</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="alloptions" searchWhenChanged="true">
      <label>Options ($optioncount$) $alloptions$</label>
      <choice value="All">All</choice>
      <search>
        <query>
| makeresults count=10
| streamstats count as row
| eval option="Option ".mvindex(split("ABCDEFGHIJ",""),row-1)
| eval label="Option ".mvindex(split("abcdefghij",""),row-1)
| table option label
        </query>
      </search>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>option</fieldForValue>
      <delimiter>,</delimiter>
      <change>
        <eval token="optioncount">mvcount('form.alloptions')</eval>
        <eval token="form.alloptions">case(mvcount('form.alloptions')=0,"All",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"All")&gt;0,"All",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"All")=0,mvfilter('form.alloptions'!="All"),1==1,'form.alloptions')</eval>
      </change>
    </input>
  </fieldset>
</form>
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You need to do this with JS, so save this javascript into your_app/appserver/static folder and then in your dashboard set

<form script="multiselect.js"...>

and then in your input, do

<input type="multiselect" id="multi_1"...>

 

require([
  'jquery',
  'underscore',
  'splunkjs/mvc',
  'splunkjs/mvc/simplexml/ready!'
],
function($, _, mvc) {

  var multi1 = mvc.Components.get("multi_1");
  if (multi1 != null) {
    multi1.on("change", function() {
      var currentVal = multi1.val();
      var first = multi1.options.choices[0].value;
      if (currentVal.length > 1 && currentVal.indexOf(first) >= 0) {
        multi1.val(_.without(currentVal, first));
      }
      else if (currentVal.length == 0) {
        multi1.val(first);
      }
    });
  }
});

 

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...