Dashboards & Visualizations

choose all Multiselect values by default without using *

Path Finder

I have a multi-select who has its values populated by a lookup.If the lookup has 3 rows all three values show up.
I want this multi-select to have all the values chosen by default WITHOUT USING ALL(*)
All values should show up in the area of multi-select as chosen.
If any leads kindly help
or suggest some other input type can be used to fulfill this.

Engager

You can actually do this in your search by building the "All" value and then appending the set of individual values. You also have to make sure to use the "fieldforlabel" and "fieldforvalue" properties of the multi select.

Your search will look something like this:

| inputlookup ServersList
| where Environment like "Development" AND ApplicationName like "MyApplication" 
| stats values(ServerName) as hostValues by _time 
| eval hostFilter="(host=\"".mvjoin(hostValues, "\" OR host=\"")."\")" 
| eval ServerLabel = "All" 
| rename hostFilter as ServerValue 
| append 
    [| inputlookup ProgServers 
    | where Environment like "Development" AND ApplicationName like "MyApplication" 
    | dedup ServerName 
    | sort +ServerName
    | rename ServerName as ServerLabel 
    | eval ServerValue = "host=\"".ServerLabel."\"" ]

Notice the ServerLabel in the first search is "All", this is what will be displayed in the multi select to the user. The value is a set of OR statements that contain the same values as what is in the second search. Enjoy!!

Path Finder

Figured this one out just yesterday:

<input type="multiselect" token="tokMulti2">
   <label></label>
   <choice value="value1">Field 1</choice>
   <choice value="value2">Field 2</choice>
   <choice value="value3">Field 3</choice>
   <default>"Field 1","Field 2","Field 3"</default>
   <delimiter> </delimiter>
 </input>

Yours would also work if you used initialValue instead of default.

 <input type="multiselect" token="tokMulti3">
   <label></label>
   <choice value="value1">Field 1</choice>
   <choice value="value2">Field 2</choice>
   <choice value="value3">Field 3</choice>
   <initialValue>value1,value2,value3</initialValue>
   <delimiter> </delimiter>
 </input>

Hope this helps.

0 Karma

SplunkTrust
SplunkTrust

Hi

Can you please try this? I did it with the use javascript. I hope It will help to you.

XML - Code

<form script="MultiDropdownView.js">
  <label>Multi Select Default value MultiDropdownView</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="tknSelectIndex" id="idSelectIndex">
      <label>Select Index</label>
      <fieldForLabel>index</fieldForLabel>
      <fieldForValue>index</fieldForValue>
      <search id="idSearchSelectIndex">
        <query>| eventcount summarize=false index=* index=_* | dedup index | fields index</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
</form>

MultiDropdownView.js

var deps = [
    "splunkjs/ready!"
];
require(deps, function(mvc) {

    var idSelectIndex = mvc.Components.get('idSelectIndex');
    var allValues = [];

    var idSearchSelectIndex = mvc.Components.get("idSearchSelectIndex");
    var idSearchSelectIndex_results = idSearchSelectIndex.data("preview");
    idSearchSelectIndex_results.on("data", function() {
         $.each(idSearchSelectIndex_results.data().rows, function( index, value ) {
            allValues.push(value[0]);
        });
        idSelectIndex.settings.set("default",allValues);
     });
});

Thanks

Splunk Employee
Splunk Employee

that's great! Thank you for sharing.

0 Karma

Engager

Thanks, it helped for me. But one short question. What is reason for these two lines:

var defaultTokenModel = mvc.Components.get('default');
var submittedTokens = mvc.Components.get('submitted');

Cant see you are using the variabels.

SplunkTrust
SplunkTrust

@stephanfuchs
Good Catch. Yes, these variable are unused. I have updated my answer.

Thanks 🙂

0 Karma

Legend

@architkhanna, is your multiselect formed by static values or dynamic values? If it is dynamic is the list of fields/values limited or same?

For static values you can use <default> option to set the default values on load. Following is an example:

<input type="multiselect" token="tokMulti2">
  <label></label>
  <choice value="value1">Field 1</choice>
  <choice value="value2">Field 2</choice>
  <choice value="value3">Field 3</choice>
  <default>value1,value2,value3</default>
  <delimiter> </delimiter>
</input>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Path Finder

no this is not static value..as mentioned taken from the lookup.the lookup can be modified at any point of time

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!