Remove ALL from multi-select input once any value is selected

[Karthikeya]

Hello,

I have a requirement in dashboard. My multiselect input should remove ALL (default value) if I select any value other than that automatically and ALL should return if I deselect the selected value... Please help me to get this result?

<input type="multiselect" token="app_name">
<label>Application Name</label>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>app_name</fieldForLabel>
<fieldForValue>app_name</fieldForValue>

<search base="base_search">
<query> |stats count by app_name </query>
</search>
<valuePrefix>app_name="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
</input>

[marycordova]

I don't think you actually want to remove "ALL" from the multi-select...it makes it so people can go back to the default when they are done with whatever choice they made originally.  I would say if you don't want people to go back to the default...then maybe you don't it there at all in the first place?  Or maybe you don't actually want a multi-select but just a regular drop-down list?  But it seems to me if you want it there in the first place, you actually want it there always so people can revert back to the default behavior of the dashboard when they are done messing around 😊 (IMO).

[ITWhisperer]

You can do this without javascript - here is a SimpleXML example

    <input type="multiselect" token="alloptions" searchWhenChanged="true">
      <label>Options $alloptions$</label>
      <choice value="All">All</choice>
      <search>
        <query>
| makeresults count=20
| streamstats count as row
| eval option="Option ".mvindex(split("ABCDEFGHIJKLMNOPQRSTUVWXYZ",""),row-1)
| eval label="Option ".mvindex(split("abcdefghijklmnopqrstuvwxyz",""),row-1)
| table option label
        </query>
      </search>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>option</fieldForValue>
      <delimiter>,</delimiter>
      <change>
        <eval token="form.alloptions">case(mvcount('form.alloptions')=0,"All",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"All")&gt;0,"All",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"All")=0,mvfilter('form.alloptions'!="All"),1==1,'form.alloptions')</eval>
      </change>
    </input>

[Karthikeya]

Here is my existing multiselect XML..

<input type="multiselect" token="app_name">

<label>Application Name</label>

<choice value="*">All</choice>

<default>*</default>

<initialValue>*</initialValue>

<fieldForLabel>app_name</fieldForLabel>

<fieldForValue>app_name</fieldForValue>

<search base="base_search">

<query> |stats count by app_name </query>

</search>

<valuePrefix>app_name="</valuePrefix>

<valueSuffix>"</valueSuffix>

<delimiter> OR </delimiter>

</input>

[ITWhisperer · Accepted solution]

Try like this - note that your search needs to use the $app_name_choice$ token not $app_name$

    <input type="multiselect" token="app_name">
      <label>Application Name</label>
      <choice value="All">All</choice>
      <default>All</default>
      <initialValue>*</initialValue>
      <fieldForLabel>app_name</fieldForLabel>
      <fieldForValue>app_name</fieldForValue>
      <search base="base_search">
        <query> |stats count by app_name </query>
      </search>
      <valuePrefix>app_name="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <change>
        <eval token="form.app_name">case(mvcount('form.app_name')=0,"All",mvcount('form.app_name')&gt;1 AND mvfind('form.app_name',"All")&gt;0,"All",mvcount('form.app_name')&gt;1 AND mvfind('form.app_name',"All")=0,mvfilter('form.app_name'!="All"),1==1,'form.app_name')</eval>
        <eval token="app_name_choice">if('form.app_name'=="All","app_name=\"*\"",'app_name')</eval>
      </change>
    </input>

[visrama]

It's my understanding that <change> is not available for the multiselect input.

https://docs.splunk.com/Documentation/Splunk/8.1.4/Viz/PanelreferenceforSimplifiedXML?_gl=1*1rio3cu*...

I've tried the XML solution recommended and it is not working in my Splunk 9.4x environment.

[ITWhisperer]

The solution works with 10.0 despite what the documentation says, and I am fairly confident that it also worked with earlier versions, although I do not have access to those environment at present. If it is not working for you, please can you provide more details e.g. exactly what you have in the source of your dashboards, what errors (if any) are reported, what works and does not work.

[visrama]

Here is the XML section of my multiselect input:

    <input type="multiselect" token="usecase" depends="$show_usecase$">
      <label>Select Use Case</label>
      <choice value="All">All</choice>
      <default>All</default>
      <search>
        <query>my spl here
| stats count by use_case_title
| fields - count
| sort use_case_title</query>
      </search>
      <fieldForLabel>use_case_title</fieldForLabel>
      <fieldForValue>use_case_title</fieldForValue>
      <initialValue>*</initialValue>
      <prefix>"(</prefix>
      <suffix>)"</suffix>
      <valuePrefix>\"</valuePrefix>
      <valueSuffix>\"</valueSuffix>
      <delimiter>,</delimiter>
      <change>
        <eval token="form.usecase">case(mvcount('form.usecase')=0,"All",mvcount('form.usecase')&gt;1 AND mvfind('form.usecase',"All")&gt;0,"All",mvcount('form.usecase')&gt;1 AND mvfind('form.usecase',"All")=0,mvfilter('form.usecase'!="All"),1==1,'form.usecase')</eval>
        <eval token="usecase_choice">if('form.usecase'=="All","(\"*\")",'usecase')</eval>
      </change>
    </input>

 
I have updated my panel search to use the token "usecase_choice" as directed.

  <row>
    <panel>
      <title>Report Results</title>
      <table>
        <search id="dynamic_report_search">
          <query>
            | savedsearch "$report_name$" functional_area="$bunit$" usecase=$usecase_choice$
          </query>
          <earliest>$time_range.earliest$</earliest>
          <latest>$time_range.latest$</latest>
        </search>
        <option name="count">50</option>
      </table>
    </panel>
  </row>

When the dashboard comes up the default in the input is "All" but when I click on any of the other selections it quickly "flashes" like its adding the selection to the multiselect input and then just reverts back to "All"

[ITWhisperer]

Try this dashboard

<form version="1.1" theme="light">
  <label>Multi-select usecase</label>
  <init>
    <set token="show_usecase"></set>
  </init>
  <fieldset submitButton="false">
    <input type="multiselect" token="usecase" depends="$show_usecase$">
      <label>Select Use Case</label>
      <choice value="All">All</choice>
      <default>All</default>
      <search>
        <query>| makeresults
| eval use_case_title=split("NRC1: High Severity IDS Alert,NRC2: New Malware Detection,NRC3: Splunk Health Check Failed,NRC4: Too Many Failed Logins per Device",",")
| mvexpand use_case_title
| sort use_case_title</query>
      </search>
      <fieldForLabel>use_case_title</fieldForLabel>
      <fieldForValue>use_case_title</fieldForValue>
      <initialValue>*</initialValue>
      <prefix>"(</prefix>
      <suffix>)"</suffix>
      <valuePrefix>\"</valuePrefix>
      <valueSuffix>\"</valueSuffix>
      <delimiter>,</delimiter>
      <change>
        <eval token="form.usecase">case(mvcount('form.usecase')=0,"All",mvcount('form.usecase')&gt;1 AND mvfind('form.usecase',"All")&gt;0,"All",mvcount('form.usecase')&gt;1 AND mvfind('form.usecase',"All")=0,mvfilter('form.usecase'!="All"),1==1,'form.usecase')</eval>
        <eval token="usecase_choice">if('form.usecase'=="All","(\"*\")",'usecase')</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Report Results</title>
      <table>
        <search id="dynamic_report_search">
          <query>
            | makeresults
            | fields - _time
            | eval usecase_choice=$usecase_choice$
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">50</option>
      </table>
    </panel>
  </row>
</form>

Obviously, I have tweaked the searched to dummy up the data. Assuming this basic dashboard works, (as it does in my environment), then I suspect there is something else going on in your dashboard which you haven't shown e.g. your actual spl and my best guess is that there are other searches and tokens being changed which is affecting how the dashboard operates.

[visrama]

I tried your dashboard XML and it does indeed work. I am stumped...  Here is the XML for the usecase input as well as the bunit input which the use case input uses in its dynamic query. When the bunit is changed it clears out the form.usecase and usecase tokens which shouldn't impact the remove "All" eval token functionality. The usecase multiselect is getting populated with the correct values based on the bunit selected.

    <input type="dropdown" token="bunit" depends="$show_bunit$">
      <label>Select Functional Area</label>
      <search>
        <query>| rest /services/authentication/current-context splunk_server=local | table roles
              | mvexpand roles
              | eval label=case(match(roles,"grid"),"GRID",match(roles,"gstn"),"GSTN",match(roles,"it"),"IT",match(roles,"psec"),"PSEC",match(roles,"admin|cso|csi"),"GRID|GSTN|IT|PSEC|All")
              | makemv delim="|" label
              | mvexpand label
              | eval value=if(label=="All","*",label)
              | stats count by label value
              | fields - count
        </query>
        <earliest>-24h</earliest>
      </search>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <change>
        <unset token="form.usecase"></unset>
        <unset token="usecase"></unset>
      </change>
    </input>
    <input type="multiselect" token="usecase" depends="$show_usecase$">
      <label>Select Use Case</label>
      <choice value="All">All</choice>
      <default>All</default>
      <search>
        <query>index=ame_$bunit$ NOT index=ame_default sourcetype="ame-initial-entry" earliest=1
| rex field=event.event_title "^(?&lt;use_case_number&gt;[^\:\-]+)(\:|\-)"
| lookup use_case_asset_field_lookup.csv use_case_number
| stats count by use_case_title
| fields - count
| sort use_case_title</query>
      </search>
      <fieldForLabel>use_case_title</fieldForLabel>
      <fieldForValue>use_case_title</fieldForValue>
      <initialValue>*</initialValue>
      <prefix>"(</prefix>
      <suffix>)"</suffix>
      <valuePrefix>\"</valuePrefix>
      <valueSuffix>\"</valueSuffix>
      <delimiter>,</delimiter>
      <change>
        <eval token="form.usecase">case(mvcount('form.usecase')=0,"All",mvcount('form.usecase')&gt;1 AND mvfind('form.usecase',"All")&gt;0,"All",mvcount('form.usecase')&gt;1 AND mvfind('form.usecase',"All")=0,mvfilter('form.usecase'!="All"),1==1,'form.usecase')</eval>
        <eval token="usecase_choice">if('form.usecase'=="All","(\"*\")",'usecase')</eval>
      </change>
    </input>

[visrama]

@ITWhisperer - interesting thing to note. When I added the "Submit" button to your dashboard it behaved in the same manner as my developed dashboard. I went to my dashboard and changed the Submit button to false and set the Search on Changed = true for my inputs. The multiselect functionality now works when I select a value other than All. Can you test in your environment and see if you get the same results?

[bowesmana]

When you add the submit button, the change event will not fire I believe because it has not "changed" until the submit occurs.

@ITWhisperer 's solution is the generally accepted one for this multiselect reset, despite the docs saying that change is not supported, it does work and has been working for a long time.

[visrama]

Ah okay. I have other inputs that also need to be selected. So what I did was added the Submit button back but enabled "search on change" for my multiselect input. That seems to be doing the job. Just need to test some more.

[Karthikeya]

@ITWhisperer thanks for the code. It is working but my doubt as per your comment - do I replace $app_name$ token with $app_name_choice$ in all my panels? Because even though I didn't change my panels are refreshing at the moment according to multiselect options given. Please confirm do I need to replace?

[ITWhisperer]

You probably do need to use app_name_choice in your panels if you want the All option to be converted to * otherwise your search will be for app_name="All" which is probably not what you want!

[Karthikeya]

@ITWhisperer thanks for the reply. Where I need to give this input? In my existing multiselect input?

[Karthikeya]

In which component ( I mean deployer or direct search head) I need to give this JS? can you please specify full path?

[livehybrid]

Hi @Karthikeya 

To achieve this you are probably best using some Javascript, have a look at these two links as I think they contain working examples for you to use:

https://community.splunk.com/t5/Dashboards-Visualizations/Remove-quot-All-quot-from-Multiselect-Inpu...

https://community.splunk.com/t5/Dashboards-Visualizations/How-to-get-rid-of-default-quot-All-quot-fr...

Please let me know how you get on and consider upvoting/karma this answer if it has helped.
Regards

Will

[livehybrid]

Essentially you need to create the following in a allSelect.js file in appname/appserver/static:

require([
     'jquery',
     'splunkjs/mvc',
     'splunkjs/mvc/simplexml/ready!'
 ], function($, mvc){
         $('#multi').on("change",function(){
                 var multi1 = mvc.Components.get("multi");
                 var tokens = mvc.Components.getInstance("default");
                 var mytoken = tokens.get("multi")

                  if (mytoken.length > 1 && mytoken.includes("All"))
                 {
                     // If "All" was selected before current (more specific) selection, remove it from list
                     if (indexOfAll == 0) 
                     {
                         var temp = mytoken.split(" ")
                         var temp1 = temp[1]
                         multi1.val(temp1);
                     } else 
                     {
                         // "All" was selected last, clear input and leave only "All" in it
                         multi1.val("All");
                     }
                 }


 }); 
 }); 

Then update the first line of your dashboard to something like this:

<form script="allSelect.js">