Classic UI does not have a provision to allow "select all choices" with one click. But you can make an entry that has all choices. Maintainability of such a code depends on how you populate this mu...
See more...
Classic UI does not have a provision to allow "select all choices" with one click. But you can make an entry that has all choices. Maintainability of such a code depends on how you populate this multivalue input. It can be very easy if the input is populated by a search. Just use appendpipe, like this index=_internal
| stats count by group
| eval label = group
| appendpipe
[stats values(group) as group
| eval label = "All"] In this example, I want an input that can select one or more values from field group. For "normal" entries, label will be the same as group value. But I use appendpipe to add a row with label "All". Here is a complete example for you to play with and compare with real use case: <form version="1.1" theme="dark">
<label>"Select all choices"</label>
<description>https://community.splunk.com/t5/Splunk-Search/Multiselect-filter-Select-all-matches-in-classic-dashboard/m-p/741079#M240547</description>
<fieldset submitButton="false">
<input type="multiselect" token="group_tok" searchWhenChanged="true">
<label>Select groups</label>
<fieldForLabel>label</fieldForLabel>
<fieldForValue>group</fieldForValue>
<search>
<query>index=_internal
| stats count by group
| eval label = group
| appendpipe
[stats values(group) as group
| eval label = "All"]</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<initialValue>bucket_metrics,cachemgr_bucket,conf,deploy-connections,deploy-server,dutycycle,executor,instance,kvstore_connections,map,mpool,parallel_reduce_metric,per_host_agg_cpu,per_host_lb_cpu,per_host_msp_cpu,per_host_thruput,per_index_agg_cpu,per_index_lb_cpu,per_index_msp_cpu,per_index_thruput,per_source_agg_cpu,per_source_lb_cpu,per_source_msp_cpu,per_source_thruput,per_sourcetype_agg_cpu,per_sourcetype_lb_cpu,per_sourcetype_msp_cpu,per_sourcetype_thruput,pipeline,pipelineset,queue,realtime_search_data,regex_cache,search_concurrency,search_health_metrics,search_pool,searchscheduler,spacemgr,subtask_seconds,tailingprocessor,telemetry_metrics_buffer,thruput,tpool,uihttp,version_control</initialValue>
<delimiter> </delimiter>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index=_internal group IN ($group_tok$)
| stats count by group</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form> If the multiple choices are static, the code will be harder to maintain because every time you add or delete an entry, you must add or delete from two places. (In this case, use of makeresults may help maintain sanity.) Hope this helps.