How to have the Dynamic dropdown select All from dropdown list only?

[sb01splunk]

I currently have a dropdown that is working properly but I want to add an All selection and make it default. The problem I am running into is either it will select all items in the inputlookup or it will return nothing.

XML for working dropdown:

  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="ProjectName" searchWhenChanged="true">
      <label>Project Name</label>
      <fieldForLabel>PROJ_NAME</fieldForLabel>
      <fieldForValue>PROJ_NAME</fieldForValue>
      <search>
        <query>| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>

This will create a dropdown like:

Project ABC
Project DEF
Project XYZ

And yes there are spaces in the output.

I have tried something like this:

  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="ProjectName" searchWhenChanged="true">
      <label>Project Name</label>
      <fieldForLabel>PROJ_NAME</fieldForLabel>
      <fieldForValue>PROJ_NAME</fieldForValue>
      <search>
        <query>| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
        <choice value="*">All Projects</choice>
          <default>*</default>
          <initialValue>*</initialValue>
    </input>
  </fieldset>

But this returns ALL ProjectCodes and is not limiting it to 99*

I also tried the following:

  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="ProjectName" searchWhenChanged="true">
      <label>Project Name</label>
      <fieldForLabel>PROJ_NAME</fieldForLabel>
      <fieldForValue>PROJ_NAME</fieldForValue>
      <search>
        <query>| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
       <choice value="all_projects">All Projects</choice>
       <change>
         <condition value="all_projects">
           <set token="queryFilter">[| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME]</set>
         </condition>
         <condition>
           <set token="queryFilter">PROJ_NAME="$value$"</set>
         </condition>
       </change>
    </input>
  </fieldset>

This just returns nothing.

Any help would be greatly appreciated.

[Taruchit]

Hi @sb01splunk,

I tried using your second code, but the value of token "ProjectName" as all_projects 

It does not take the query results in the dropdown. 

Can you please suggest how to resolve it?

Thank you
Taruchit

[sandeepmakkena]

| inputlookup assets.csv | return ProjectCode | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode

Try this and also you can also try without the table part in your query. You don't have to use the table in a dropdown search.
Hope this helps. Thanks for the question.

[dyapasrikanth]

After looking into network logs in browser I figured it out like sort command is truncating the results to 10000 rows. May be I should avoid it as dropdown already having the filter option (autocomplete).

messages: [{type: "INFO", text: "The sort command is truncating output to 10000 rows"}]
preview: false
results: [{env_name: "mlcd1", count: "1"}, {env_name: "mlcd2", count: "1"}, {env_name: "mlct1", count: "1"},…]
0: {env_name: "mlcd1", count: "1"}
1: {env_name: "mlcd2", count: "1"}
2: {env_name: "mlct1", count: "1"}
3: {env_name: "mlct2", count: "1"}
4: {env_name: "np1", count: "1"}