Dashboards & Visualizations

How to have the Dynamic dropdown select All from dropdown list only?

sb01splunk
Explorer

I currently have a dropdown that is working properly but I want to add an All selection and make it default. The problem I am running into is either it will select all items in the inputlookup or it will return nothing.

XML for working dropdown:

  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="ProjectName" searchWhenChanged="true">
      <label>Project Name</label>
      <fieldForLabel>PROJ_NAME</fieldForLabel>
      <fieldForValue>PROJ_NAME</fieldForValue>
      <search>
        <query>| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>

This will create a dropdown like:

Project ABC
Project DEF
Project XYZ

And yes there are spaces in the output.

I have tried something like this:

  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="ProjectName" searchWhenChanged="true">
      <label>Project Name</label>
      <fieldForLabel>PROJ_NAME</fieldForLabel>
      <fieldForValue>PROJ_NAME</fieldForValue>
      <search>
        <query>| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
        <choice value="*">All Projects</choice>
          <default>*</default>
          <initialValue>*</initialValue>
    </input>
  </fieldset>

But this returns ALL ProjectCodes and is not limiting it to 99*

I also tried the following:

  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="ProjectName" searchWhenChanged="true">
      <label>Project Name</label>
      <fieldForLabel>PROJ_NAME</fieldForLabel>
      <fieldForValue>PROJ_NAME</fieldForValue>
      <search>
        <query>| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
       <choice value="all_projects">All Projects</choice>
       <change>
         <condition value="all_projects">
           <set token="queryFilter">[| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME]</set>
         </condition>
         <condition>
           <set token="queryFilter">PROJ_NAME="$value$"</set>
         </condition>
       </change>
    </input>
  </fieldset>

This just returns nothing.

Any help would be greatly appreciated.

Labels (1)
0 Karma

Taruchit
Communicator

Hi @sb01splunk,

I tried using your second code, but the value of token "ProjectName" as all_projects 

It does not take the query results in the dropdown. 

Can you please suggest how to resolve it?

Thank you
Taruchit

0 Karma

sandeepmakkena
Contributor
| inputlookup assets.csv | return ProjectCode | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode

Try this and also you can also try without the table part in your query. You don't have to use the table in a dropdown search.
Hope this helps. Thanks for the question.

0 Karma

dyapasrikanth
Path Finder

After looking into network logs in browser I figured it out like sort command is truncating the results to 10000 rows. May be I should avoid it as dropdown already having the filter option (autocomplete).

messages: [{type: "INFO", text: "The sort command is truncating output to 10000 rows"}]
preview: false
results: [{env_name: "mlcd1", count: "1"}, {env_name: "mlcd2", count: "1"}, {env_name: "mlct1", count: "1"},…]
0: {env_name: "mlcd1", count: "1"}
1: {env_name: "mlcd2", count: "1"}
2: {env_name: "mlct1", count: "1"}
3: {env_name: "mlct2", count: "1"}
4: {env_name: "np1", count: "1"}
0 Karma
Get Updates on the Splunk Community!

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...