How do I dynamically populate "All" option in multi-select input filter?

[fuwuqi]

I have two input filters on my dashboard: the first one is a single-select dropdown input which allows a user to select to first select the sales leader; and the second is multi-select input that allows to select the salespersons for which the reporting panels will generate results for.

At the moment, the second salespersons multi-select input has been designed to extract a list of salespersons reporting to the selected sales leader upon detecting a change the first sales leader dropdown input. The typical user behavior is to click and select salespersons for which he/she wishes to view the reports for. But sometimes there is a need to view the reports for all the salespersons under the selected sales leader and it can be quite tedious to select salespersons one-by-one especially if the list is long. To facilitate the selection of all the salespersons reporting to the sales leader, an "All" option that dynamically populates itself with this list needs to be included. Any advice on how to dynamically populate this "All" option?

[mstjohn_splunk]

hi @fuwuqi,

Did the answer below solve your problem? If so, please resolve this post by approving it!
If your problem is still not solved, keep us updated so that someone else can help ya.

Thanks for posting!

[kmaron]

You should be able to just add a static option of all and make the value be *. Then it will always be available as an option regardless of what your search returns.

[fuwuqi]

The * will just result in the entire selection of salespersons. What I needed is a subselection of salespersons under the selected salesleader when "all" is selected for salespersons. Using this subselection I can then filter the other results panel by writing this in the query: salesperson_id IN $salespersons$, where $salespersons$ is the token containing the subselection.

[harishalipaka]

hi @fuwuqi

Install this app it will help you allot.

https://splunkbase.splunk.com/app/1603/

[Updated]

<form>
  <label>multiselect</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="select" searchWhenChanged="true">
      <label>selection</label>
      <delimiter> or </delimiter>
      <fieldForLabel>Name</fieldForLabel>
      <fieldForValue>Name</fieldForValue>
      <search>
        <query>|makeresults |eval Name="Hari" |append [|makeresults |eval Name="sandy" ]|append [|makeresults |eval Name="siri" ]|append [|makeresults |eval Name="july" ] |table Name</query>
      </search>
      <choice value="%">All</choice>
      <valuePrefix>Name like ("</valuePrefix>
      <valueSuffix>")</valueSuffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>selected list</title>
        <search>
          <query>|makeresults |eval Name="Hari" |append [|makeresults |eval Name="sandy" ]|append [|makeresults |eval Name="siri" ]|append [|makeresults |eval Name="july" ]|where  $select$  |table Name</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <done>
             <set token="allSalespersons">$result.Name$</set>
           </done>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <search>
          <query>|makeresults |eval Name="Hari" |append [|makeresults |eval Name="sandy" ]|append [|makeresults |eval Name="siri" ]|append [|makeresults |eval Name="july" ]|where  $select$  |mvcombine delim="," Name |nomv Name </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</form>

[fuwuqi]

Thanks @harishalipaka. I finally made this work by making the single value responsive to both the salesleader filter and the salespersons filter, see code below for the code if anyone faces the same issue.

I would to hear from others if anyone has a more elegant solution that doesn't require writing css to hide the extra single value panel like this one?

<row>
     <panel>
       <single>
         <search>
           <query>index="index_salespersons"
 salespersons_leader_id = $leader$
 salespersons_id in $salespersons$
 |stats list(salespersons_id) as salespersonsList
 |eval salespersonsIds = mvjoin(salespersonsList, ",")
 |fields salespersonsIds</query>
           <earliest>0</earliest>
           <latest></latest>
           <done>
             <set token="allSalespersons">$result.salespersonsIds$</set>
           </done>
         </search>
         <option name="drilldown">none</option>
       </single>
     </panel>
   </row>

[fuwuqi]

Thanks for the quick response. I had experimented with the dashboard example app when I was learning Splunk and I checked it out again after your comment but I don't see an example that addresses my problem. The code you offered doesn't seem to solve problem.

I have in fact tried something similar to create a single value panel with a search query that is responsive to the selection of salesleader. The search query creates a string value that I assigned to a token in the hope that other panels could use its value to filter the results i.e. the salesperson ids contained in the token, but this doesn't seem to work. Code from the single panel as follows:

<row>
    <panel>
      <single>
        <search>
          <query>index="index_salespersons"
salespersons_leader_id = $leader$
|stats list(salespersons_id) as salespersonsList
|eval salespersonsIds = mvjoin(salespersonsList, ",")
|fields salespersonsIds</query>
          <earliest>0</earliest>
          <latest></latest>
          <done>
            <set token="allSalespersons">$result.salespersonsIds$</set>
          </done>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>