Splunk Search

How to set one dropdown to default value (for ex: All) when i select values from the 2nd dropdown

rijinc
Explorer

there are two computed dropdown, just in case i select values from one dropdown the other dropdown should be reset to default(all) and vice versa.

I was entering something like this :

    <label>Deal Size</label>
    <default>*</default>
    <prefix>"</prefix>
    <suffix>"</suffix>
    <fieldForLabel>DealSize</fieldForLabel>
    <fieldForValue>DealSize</fieldForValue>
    <search>
      <query>| stats count by DealSize | dedup DealSize | fields DealSize</query>
    </search>
    <initialValue>*</initialValue>
    <choice value="*">All</choice>
     **<change>
     <set token="form.Fiscal_Year">*</set>
    </change>**
  </input>
  <input type="dropdown" token="Fiscal_Year" searchWhenChanged="true">
    <label>Fiscal Year</label>
    <default>All</default>
    <prefix>"</prefix>
    <suffix>"</suffix>
    <fieldForLabel>Fiscal_Year</fieldForLabel>
    <fieldForValue>Fiscal_Year</fieldForValue>
    <search>
      <query>| stats count by Fiscal_Year | dedup Fiscal_Year | fields Fiscal_Year</query>
    </search>
    <initialValue>*</initialValue>
    <choice value="*">All</choice>
     **<change>
<set token="form.DealSize">*</set>
    </change>**
  </input>

this is not getting set vice versa ...please let me know how this is possible ?

Tags (1)

niketn
Legend

Please add condition block to set the other dropdown as asterisk (*) only if the selected value in the current dropdown is not asterisk (*) i.e. <condition match="$value$!=&quot;*&quot;">

    <input type="dropdown" token="DealSize" searchWhenChanged="true">
     <label>Deal Size</label>
     <default>*</default>
     <prefix>"</prefix>
     <suffix>"</suffix>
     <fieldForLabel>DealSize</fieldForLabel>
     <fieldForValue>DealSize</fieldForValue>
     <search>
       <query>| stats count by DealSize | dedup DealSize | fields DealSize</query>
     </search>
     <initialValue>*</initialValue>
     <choice value="*">All</choice>
      <change>
        <condition match="$value$!=&quot;*&quot;">
          <set token="form.Fiscal_Year">*</set>
        </condition>
      </change>
    </input>
   <input type="dropdown" token="Fiscal_Year" searchWhenChanged="true">
     <label>Fiscal Year</label>
     <default>All</default>
     <prefix>"</prefix>
     <suffix>"</suffix>
     <fieldForLabel>Fiscal_Year</fieldForLabel>
     <fieldForValue>Fiscal_Year</fieldForValue>
     <search>
       <query>| stats count by Fiscal_Year | dedup Fiscal_Year | fields Fiscal_Year</query>
     </search>
     <initialValue>*</initialValue>
      <change>
        <condition match="$value$!=&quot;*&quot;">
          <set token="form.DealSize">*</set>
        </condition>
      </change>      
    </input>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...