Splunk Search

Multi Select ALL value shows no data

Neel88
Explorer

Hello,

I am using 2 multi select dropdown. When its on  the default value  'ALL' then it doesn't show any value in the table, after selection it works. 

Neel88_0-1675393384547.png

Neel88_1-1675393685675.png

 

After open in search, it shows "*" in the value.

| loadjob savedsearch="TEST"
| where FLOW IN("*") and adt IN("*")
| table adt, FLOW, Date
| fields Date, adt, FLOW, CMTotal

------------------------------------------------------------------

Original Query- 

<form>

  <label>AAA_Test</label>

  <fieldset submitButton="false">

    <input type="multiselect" token="flow">

      <label>Select Flow</label>

      <choice value="*">All</choice>

      <default>*</default>

      <delimiter>,</delimiter>

      <fieldForLabel>FLOW</fieldForLabel>

      <fieldForValue>FLOW</fieldForValue>

      <search>

        <query>| loadjob savedsearch="TEST" | dedup FLOW</query>

        <earliest>0</earliest>

        <latest></latest>

      </search>

      <prefix>IN(</prefix>

      <suffix>)</suffix>

      <valuePrefix>"</valuePrefix>

      <valueSuffix>"</valueSuffix>

      <initialValue>*</initialValue>

    </input>

    <input type="multiselect" token="adt">

      <label>Select ADT</label>

      <choice value="*">All</choice>

      <default>*</default>

      <delimiter>,</delimiter>

      <fieldForLabel>adt</fieldForLabel>

      <fieldForValue>adt</fieldForValue>

      <search>

        <query>| loadjob savedsearch="TEST" | dedup adt</query>

        <earliest>0</earliest>

        <latest></latest>

      </search>

      <prefix>IN(</prefix>

      <suffix>)</suffix>

      <valuePrefix>"</valuePrefix>

      <valueSuffix>"</valueSuffix>

      <initialValue>*</initialValue>

    </input>

  </fieldset>

  <row>

    <panel>

      <table>

        <search>

          <query>| loadjob savedsearch="TEST"

          | where FLOW $flow$ and adt $adt$

          | table adt, FLOW, Date, NbRecordsOKFCR, CMTotal, NbRecordsOKCM, NBIntFile, NB1, NB2, NB3, NbErrorsCM, Alert

          | fields Date, adt, FLOW, CMTotal</query>

          <earliest>0</earliest>

          <latest></latest>

        </search>

        <option name="count">10</option>

        <option name="drilldown">none</option>

        <option name="refresh.display">progressbar</option>

      </table>

    </panel>

  </row>

</form>

Please suggest.

0 Karma

yeahnah
Motivator
0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...