Make a SimpleXML multiselect revert to default value upon emptying box

[Jason]

I have a (Splunk 6.x+ SimpleXML) multiselect dropdown populating a token that is used by other charts on a dashboard.

The input references a static choice to ensure "ANY" (a value of fieldname=*) gets passed upon loading the dashboard.

Users can select one or more other values, remove the default ANY if desired, and it works fine.

However, when removing the last item in the multiselect box, the charts disappear, as apparently the token is set back to null. How do I ensure that the token is filled (at least on the back end) with fieldname=* (or at least *) when this happens, to keep the charts visible at all times?

[shaskell_splunk]

There's no need to use this Javascript on 7.x. If you set a default value for the multi-select you can't de-select it such that it causes the viz to disappear. The default can't be removed from the multi-select.

[ashleyherbert]

Just thought I'd post an alternative way of doing this. I'm not a big fan of adding javascript to my dashboards, so I've found a way to do this by adjusting the token for the input using the change & eval attributes. See the example below from one of our dashboards:

    <input type="multiselect" token="host" searchWhenChanged="true">
      <label>Hosts</label>
      <search base="lookup">
        <query>search $env$ | dedup host</query>
      </search>
      <valuePrefix>host=</valuePrefix>
      <delimiter> OR </delimiter>
      <default>*</default>
      <choice value="*">All</choice>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <change>
        <eval token="form.host">if(mvcount('form.host')=0,"*",if(mvcount('form.host')!=1,mvfilter('form.host'!="*"),'form.host'))</eval>
      </change>
    </input>

This will reset the token to 'All' if no options are selected, and will remove the 'All' option if more than 1 are selected.

[Jason · Accepted solution]

Thanks to one of my colleagues in Professional Services, this javascript will ensure that if a multiselect box is emptied out, the first choice gets added in again.

https://gist.github.com/hobbes3/7c52b67c1de5ba4d9dfe

Copy this file into your app, restart Splunk, and add script="multiselect_force_default.js" to your opening dashboard or form tag.

[jeffland]

You might be interested in this question/answer as well.

[Jason]

Interesting. That seems to solve an issue my customer hadn't asked about, which is ALL remaining in the box upon selecting of something additional. This answer solves the removal of all selected items "breaking" the chart due to no input to the token. I'll have to take a look at your answer when I return to that client.

[support0]

Great one 🙂

[dmaislin_splunk]

In your search, add an eval=if(isnull(myfield),"*",myfield)

So your search might look like sourcetype=xyz $MYFIELDTOKEN$ | eval=if(isnull(myfield),"*",myfield) | blah blah blah....

Let me know if that works.

[Jason]

The problem is that if the search (in my case a postprocess, but I think it would work on normal searches like yours as well) calls a token, and that token is now nonexistent (due to the multiselect box being emptied out) the search will not run, and will show "waiting for data". I need to force the first option so the chart never goes blank.