Splunk Search

Multi Select ALL value shows no data

Neel88
Explorer

Hello,

I am using 2 multi select dropdown. When its on  the default value  'ALL' then it doesn't show any value in the table, after selection it works. 

Neel88_0-1675393384547.png

Neel88_1-1675393685675.png

 

After open in search, it shows "*" in the value.

| loadjob savedsearch="TEST"
| where FLOW IN("*") and adt IN("*")
| table adt, FLOW, Date
| fields Date, adt, FLOW, CMTotal

------------------------------------------------------------------

Original Query- 

<form>

  <label>AAA_Test</label>

  <fieldset submitButton="false">

    <input type="multiselect" token="flow">

      <label>Select Flow</label>

      <choice value="*">All</choice>

      <default>*</default>

      <delimiter>,</delimiter>

      <fieldForLabel>FLOW</fieldForLabel>

      <fieldForValue>FLOW</fieldForValue>

      <search>

        <query>| loadjob savedsearch="TEST" | dedup FLOW</query>

        <earliest>0</earliest>

        <latest></latest>

      </search>

      <prefix>IN(</prefix>

      <suffix>)</suffix>

      <valuePrefix>"</valuePrefix>

      <valueSuffix>"</valueSuffix>

      <initialValue>*</initialValue>

    </input>

    <input type="multiselect" token="adt">

      <label>Select ADT</label>

      <choice value="*">All</choice>

      <default>*</default>

      <delimiter>,</delimiter>

      <fieldForLabel>adt</fieldForLabel>

      <fieldForValue>adt</fieldForValue>

      <search>

        <query>| loadjob savedsearch="TEST" | dedup adt</query>

        <earliest>0</earliest>

        <latest></latest>

      </search>

      <prefix>IN(</prefix>

      <suffix>)</suffix>

      <valuePrefix>"</valuePrefix>

      <valueSuffix>"</valueSuffix>

      <initialValue>*</initialValue>

    </input>

  </fieldset>

  <row>

    <panel>

      <table>

        <search>

          <query>| loadjob savedsearch="TEST"

          | where FLOW $flow$ and adt $adt$

          | table adt, FLOW, Date, NbRecordsOKFCR, CMTotal, NbRecordsOKCM, NBIntFile, NB1, NB2, NB3, NbErrorsCM, Alert

          | fields Date, adt, FLOW, CMTotal</query>

          <earliest>0</earliest>

          <latest></latest>

        </search>

        <option name="count">10</option>

        <option name="drilldown">none</option>

        <option name="refresh.display">progressbar</option>

      </table>

    </panel>

  </row>

</form>

Please suggest.

0 Karma

yeahnah
Motivator
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...