Dashboards & Visualizations

Splunk 6.1.5: How to get the default selection from a multiselect drop-down cleared when someone selects another of the populated options in simple XML?

Lucas_K
Motivator

Has anyone found a way to get the default selection from a multiselect cleared when someone selects another of the populated options.

Example :

<label>Node</label>
<populatingSearch earliest="-5m" latest="now" fieldForLabel="host" fieldForValue="host">index=blah</populatingSearch>
<choice value="*">All</choice>
<default>*</default>
<delimiter> OR </delimiter>
<valuePrefix>host=</valuePrefix>

This drop down will populate a list of recent hosts so a user can narrow their search. A default of "all" (or "*") allow them to just click submit without knowing a specific host. They can later select a specific host of interest.

The problem is that if they do select another host (by typing a name or selecting it from the drop down) they will need to manually remove the All option. If they don't then the search will show them everything (i'm using an OR delim so they can multiselect hosts).

jeffland
SplunkTrust
SplunkTrust

I believe this is a good solution, though it is in JS and not in XML, so you'll have to modify your app code accordingly. In case this is relevant, this was only tested in Splunk 6.2.2.

Listening on a change on the multiselect, we can identify the number of selected items and whether one of the options is "*" (or whatever your "all" option results in). If this is the case, in the second if-clause we check whether the "*" was there first and the user just selected a more specific option or whether some options were selected and the user chose the "any" option. For the former case, we remove the "*" and leave the other options, and for the latter we simply replace the selection with "*". This behavior is based on the assumption that when you select the "any" option, this overrides the more specific options that were already selected. You can of course adjust this behavior to your needs.

Here is a small code example:

var selection = [];
var multi = splunkjs.mvc.Components.getInstance("input1"); // your multiselect id here

multi.on("change", function(){
    // get the current selection
    selection = multi.val();
    // check if there is more than one entry and one of them is "*"
    if (selection.length > 1 && ~(selection.indexOf("*"))) {
        if (selection.indexOf("*") == 0) {
            // "*" was first, remove it and leave rest
            selection.splice(selection.indexOf("*"), 1);
            multi.val(selection);
            multi.render();
        } else {
            // "*" was added later, remove rest and leave "*"
            multi.val("*");
            multi.render();
        }
    }
});

Cheers

martin_mueller
SplunkTrust
SplunkTrust

Mild extension: Add this to the outer if to get the default value back after deleting all entries from the list:

} else if (selection.length == 0) {
    // "*" should be inserted if the list is empty
    multi.val("*");
    multi.render();
}
0 Karma

DataOrg
Builder

@martin_mueller how to check for dispaly label instead of value"*".
my multiselect is not a * value so i want to look for a specific label value "ALL Shops"

0 Karma

sivapuvvada
Path Finder

"input1" is the token value from the multiselect or Lable name ?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

"input1" is the id of the input.

0 Karma

jeandez
Explorer

Hello,

i would like to have multiple default value . Is it possible ?

0 Karma

jeffland
SplunkTrust
SplunkTrust

I have exactly the same issue. Any chance you figured out a solution?

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...