Dashboards & Visualizations

Make a SimpleXML multiselect revert to default value upon emptying box

Jason
Motivator

I have a (Splunk 6.x+ SimpleXML) multiselect dropdown populating a token that is used by other charts on a dashboard.

The input references a static choice to ensure "ANY" (a value of fieldname=*) gets passed upon loading the dashboard.

Users can select one or more other values, remove the default ANY if desired, and it works fine.

However, when removing the last item in the multiselect box, the charts disappear, as apparently the token is set back to null. How do I ensure that the token is filled (at least on the back end) with fieldname=* (or at least *) when this happens, to keep the charts visible at all times?

1 Solution

Jason
Motivator

Thanks to one of my colleagues in Professional Services, this javascript will ensure that if a multiselect box is emptied out, the first choice gets added in again.

https://gist.github.com/hobbes3/7c52b67c1de5ba4d9dfe

Copy this file into your app, restart Splunk, and add script="multiselect_force_default.js" to your opening dashboard or form tag.

View solution in original post

shaskell_splunk
Splunk Employee
Splunk Employee

There's no need to use this Javascript on 7.x. If you set a default value for the multi-select you can't de-select it such that it causes the viz to disappear. The default can't be removed from the multi-select.

ashleyherbert
Communicator

Just thought I'd post an alternative way of doing this. I'm not a big fan of adding javascript to my dashboards, so I've found a way to do this by adjusting the token for the input using the change & eval attributes. See the example below from one of our dashboards:

    <input type="multiselect" token="host" searchWhenChanged="true">
      <label>Hosts</label>
      <search base="lookup">
        <query>search $env$ | dedup host</query>
      </search>
      <valuePrefix>host=</valuePrefix>
      <delimiter> OR </delimiter>
      <default>*</default>
      <choice value="*">All</choice>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <change>
        <eval token="form.host">if(mvcount('form.host')=0,"*",if(mvcount('form.host')!=1,mvfilter('form.host'!="*"),'form.host'))</eval>
      </change>
    </input>

This will reset the token to 'All' if no options are selected, and will remove the 'All' option if more than 1 are selected.

Jason
Motivator

Thanks to one of my colleagues in Professional Services, this javascript will ensure that if a multiselect box is emptied out, the first choice gets added in again.

https://gist.github.com/hobbes3/7c52b67c1de5ba4d9dfe

Copy this file into your app, restart Splunk, and add script="multiselect_force_default.js" to your opening dashboard or form tag.

View solution in original post

jeffland
Champion

You might be interested in this question/answer as well.

0 Karma

Jason
Motivator

Interesting. That seems to solve an issue my customer hadn't asked about, which is ALL remaining in the box upon selecting of something additional. This answer solves the removal of all selected items "breaking" the chart due to no input to the token. I'll have to take a look at your answer when I return to that client.

0 Karma

support0
Path Finder

Great one 🙂

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

In your search, add an eval=if(isnull(myfield),"*",myfield)

So your search might look like sourcetype=xyz $MYFIELDTOKEN$ | eval=if(isnull(myfield),"*",myfield) | blah blah blah....

Let me know if that works.

Jason
Motivator

The problem is that if the search (in my case a postprocess, but I think it would work on normal searches like yours as well) calls a token, and that token is now nonexistent (due to the multiselect box being emptied out) the search will not run, and will show "waiting for data". I need to force the first option so the chart never goes blank.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!