Dashboards & Visualizations

Splunk 6.1.5: How to get the default selection from a multiselect drop-down cleared when someone selects another of the populated options in simple XML?

Motivator

Has anyone found a way to get the default selection from a multiselect cleared when someone selects another of the populated options.

Example :

<label>Node</label>
<populatingSearch earliest="-5m" latest="now" fieldForLabel="host" fieldForValue="host">index=blah</populatingSearch>
<choice value="*">All</choice>
<default>*</default>
<delimiter> OR </delimiter>
<valuePrefix>host=</valuePrefix>

This drop down will populate a list of recent hosts so a user can narrow their search. A default of "all" (or "*") allow them to just click submit without knowing a specific host. They can later select a specific host of interest.

The problem is that if they do select another host (by typing a name or selecting it from the drop down) they will need to manually remove the All option. If they don't then the search will show them everything (i'm using an OR delim so they can multiselect hosts).

Champion

I believe this is a good solution, though it is in JS and not in XML, so you'll have to modify your app code accordingly. In case this is relevant, this was only tested in Splunk 6.2.2.

Listening on a change on the multiselect, we can identify the number of selected items and whether one of the options is "*" (or whatever your "all" option results in). If this is the case, in the second if-clause we check whether the "*" was there first and the user just selected a more specific option or whether some options were selected and the user chose the "any" option. For the former case, we remove the "*" and leave the other options, and for the latter we simply replace the selection with "*". This behavior is based on the assumption that when you select the "any" option, this overrides the more specific options that were already selected. You can of course adjust this behavior to your needs.

Here is a small code example:

var selection = [];
var multi = splunkjs.mvc.Components.getInstance("input1"); // your multiselect id here

multi.on("change", function(){
    // get the current selection
    selection = multi.val();
    // check if there is more than one entry and one of them is "*"
    if (selection.length > 1 && ~(selection.indexOf("*"))) {
        if (selection.indexOf("*") == 0) {
            // "*" was first, remove it and leave rest
            selection.splice(selection.indexOf("*"), 1);
            multi.val(selection);
            multi.render();
        } else {
            // "*" was added later, remove rest and leave "*"
            multi.val("*");
            multi.render();
        }
    }
});

Cheers

SplunkTrust
SplunkTrust

Mild extension: Add this to the outer if to get the default value back after deleting all entries from the list:

} else if (selection.length == 0) {
    // "*" should be inserted if the list is empty
    multi.val("*");
    multi.render();
}
0 Karma

Builder

@martin_mueller how to check for dispaly label instead of value"*".
my multiselect is not a * value so i want to look for a specific label value "ALL Shops"

0 Karma

Path Finder

"input1" is the token value from the multiselect or Lable name ?

0 Karma

SplunkTrust
SplunkTrust

"input1" is the id of the input.

0 Karma

Explorer

Hello,

i would like to have multiple default value . Is it possible ?

0 Karma

Champion

I have exactly the same issue. Any chance you figured out a solution?

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!