Dashboards & Visualizations

Splunk 6.1.5: How to get the default selection from a multiselect drop-down cleared when someone selects another of the populated options in simple XML?


Has anyone found a way to get the default selection from a multiselect cleared when someone selects another of the populated options.

Example :

<populatingSearch earliest="-5m" latest="now" fieldForLabel="host" fieldForValue="host">index=blah</populatingSearch>
<choice value="*">All</choice>
<delimiter> OR </delimiter>

This drop down will populate a list of recent hosts so a user can narrow their search. A default of "all" (or "*") allow them to just click submit without knowing a specific host. They can later select a specific host of interest.

The problem is that if they do select another host (by typing a name or selecting it from the drop down) they will need to manually remove the All option. If they don't then the search will show them everything (i'm using an OR delim so they can multiselect hosts).


I believe this is a good solution, though it is in JS and not in XML, so you'll have to modify your app code accordingly. In case this is relevant, this was only tested in Splunk 6.2.2.

Listening on a change on the multiselect, we can identify the number of selected items and whether one of the options is "*" (or whatever your "all" option results in). If this is the case, in the second if-clause we check whether the "*" was there first and the user just selected a more specific option or whether some options were selected and the user chose the "any" option. For the former case, we remove the "*" and leave the other options, and for the latter we simply replace the selection with "*". This behavior is based on the assumption that when you select the "any" option, this overrides the more specific options that were already selected. You can of course adjust this behavior to your needs.

Here is a small code example:

var selection = [];
var multi = splunkjs.mvc.Components.getInstance("input1"); // your multiselect id here

multi.on("change", function(){
    // get the current selection
    selection = multi.val();
    // check if there is more than one entry and one of them is "*"
    if (selection.length > 1 && ~(selection.indexOf("*"))) {
        if (selection.indexOf("*") == 0) {
            // "*" was first, remove it and leave rest
            selection.splice(selection.indexOf("*"), 1);
        } else {
            // "*" was added later, remove rest and leave "*"



Mild extension: Add this to the outer if to get the default value back after deleting all entries from the list:

} else if (selection.length == 0) {
    // "*" should be inserted if the list is empty
0 Karma


@martin_mueller how to check for dispaly label instead of value"*".
my multiselect is not a * value so i want to look for a specific label value "ALL Shops"

0 Karma

Path Finder

"input1" is the token value from the multiselect or Lable name ?

0 Karma


"input1" is the id of the input.

0 Karma



i would like to have multiple default value . Is it possible ?

0 Karma


I have exactly the same issue. Any chance you figured out a solution?

Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...