Using a search base with inputlookup, how do I add a static value to the data set so "All" is the first value in the drop-down?

[rharrisssi]

I've basically created a base search and am using it with a lookup. The results of the base search are all my regions. However, I want to have an "All" option in the drop-down without updating the lookup table as it's generated hourly.

  <search id="regions">
    <query>
      <![CDATA[
| inputlookup abc_sd_ipam
| stats by abc_region
      ]]>
    </query>
  </search>

[...]

    <input type="dropdown" token="abc_region" searchWhenChanged="true">
      <label>Region</label>
      <selectFirstChoice>true</selectFirstChoice>
      <allowCustomValues>false</allowCustomValues>
      <search base="regions"><query>| table abc_region</query></search>
      <fieldForLabel>abc_region</fieldForLabel>
      <fieldForValue>abc_region</fieldForValue>
    </input>

Can someone assist me with adding a static value to this data set so that "All" is the first value in the drop-down?

[rharrisssi · Accepted solution]

This turned out to be the solution:

    <input type="dropdown" token="abc_region" searchWhenChanged="true">
      <label>Region</label>
      <selectFirstChoice>false</selectFirstChoice>
      <allowCustomValues>true</allowCustomValues>
      <choice value="*">All</choice>
      <search base="regions">
        <query>| table abc_region</query>
      </search>
      <fieldForLabel>abc_region</fieldForLabel>
      <fieldForValue>abc_region</fieldForValue>
    </input>

Notice:

  <choice value="*">All</choice>

[icyfeverr]

In your search query you can do something like the below:

| inputlookup abc_sd_ipam | stats by abc_region | append [ | stats count | eval count="All" | rename count AS abc_region ]

Want to give credit to https://answers.splunk.com/answers/41525/add-a-row-to-end-of-table.html