I've basically created a base search and am using it with a lookup. The results of the base search are all my regions. However, I want to have an "All" option in the drop-down without updating the lookup table as it's generated hourly.
<search id="regions">
<query>
<![CDATA[
| inputlookup abc_sd_ipam
| stats by abc_region
]]>
</query>
</search>
[...]
<input type="dropdown" token="abc_region" searchWhenChanged="true">
<label>Region</label>
<selectFirstChoice>true</selectFirstChoice>
<allowCustomValues>false</allowCustomValues>
<search base="regions"><query>| table abc_region</query></search>
<fieldForLabel>abc_region</fieldForLabel>
<fieldForValue>abc_region</fieldForValue>
</input>
Can someone assist me with adding a static value to this data set so that "All" is the first value in the drop-down?
This turned out to be the solution:
<input type="dropdown" token="abc_region" searchWhenChanged="true">
<label>Region</label>
<selectFirstChoice>false</selectFirstChoice>
<allowCustomValues>true</allowCustomValues>
<choice value="*">All</choice>
<search base="regions">
<query>| table abc_region</query>
</search>
<fieldForLabel>abc_region</fieldForLabel>
<fieldForValue>abc_region</fieldForValue>
</input>
Notice:
<choice value="*">All</choice>
This turned out to be the solution:
<input type="dropdown" token="abc_region" searchWhenChanged="true">
<label>Region</label>
<selectFirstChoice>false</selectFirstChoice>
<allowCustomValues>true</allowCustomValues>
<choice value="*">All</choice>
<search base="regions">
<query>| table abc_region</query>
</search>
<fieldForLabel>abc_region</fieldForLabel>
<fieldForValue>abc_region</fieldForValue>
</input>
Notice:
<choice value="*">All</choice>
In your search query you can do something like the below:
| inputlookup abc_sd_ipam | stats by abc_region | append [ | stats count | eval count="All" | rename count AS abc_region ]
Want to give credit to https://answers.splunk.com/answers/41525/add-a-row-to-end-of-table.html