I am creating a Splunk dashboard and have some questions regarding the multiselect input.
1. I want to add a special option `all`, when user selects it, means all options are selected. So I added a static option `all`, but I can select both `all` and any other options, makes it looks odd, so my first question is how to make `all` option either exclusive of other options, or when i select `all`, all options will be selected automatically (except `all`)?
2. For the multiselect input, I am currently using is int a `WHERE` clause: `| where $multiselect_roles$`, currently the configuration of multiselect is:
it means the interpolated clause looks like: `| where role_name="value1" OR role_name="value2"`, my second question is when `all` is selected, how can I either emit the whole `WHERE` clause, or make it trivial, means the `WHERE` clause is there but actually it doesn’t filter anything? I tried to give the `all` option an empty string, or a `*` but both don’t work.
3. When populating the dynamic options of multiselect from query, I want to reference other inputs as query parameters.
For example, I already added an input whose token name is `environment` and another time range input, I want to only get distinct values of a column from the given environment and time range, like this: