Dashboards & Visualizations

How to have the Dynamic dropdown select All from dropdown list only?

sb01splunk
Explorer

I currently have a dropdown that is working properly but I want to add an All selection and make it default. The problem I am running into is either it will select all items in the inputlookup or it will return nothing.

XML for working dropdown:

  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="ProjectName" searchWhenChanged="true">
      <label>Project Name</label>
      <fieldForLabel>PROJ_NAME</fieldForLabel>
      <fieldForValue>PROJ_NAME</fieldForValue>
      <search>
        <query>| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>

This will create a dropdown like:

Project ABC
Project DEF
Project XYZ

And yes there are spaces in the output.

I have tried something like this:

  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="ProjectName" searchWhenChanged="true">
      <label>Project Name</label>
      <fieldForLabel>PROJ_NAME</fieldForLabel>
      <fieldForValue>PROJ_NAME</fieldForValue>
      <search>
        <query>| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
        <choice value="*">All Projects</choice>
          <default>*</default>
          <initialValue>*</initialValue>
    </input>
  </fieldset>

But this returns ALL ProjectCodes and is not limiting it to 99*

I also tried the following:

  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="ProjectName" searchWhenChanged="true">
      <label>Project Name</label>
      <fieldForLabel>PROJ_NAME</fieldForLabel>
      <fieldForValue>PROJ_NAME</fieldForValue>
      <search>
        <query>| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
       <choice value="all_projects">All Projects</choice>
       <change>
         <condition value="all_projects">
           <set token="queryFilter">[| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME]</set>
         </condition>
         <condition>
           <set token="queryFilter">PROJ_NAME="$value$"</set>
         </condition>
       </change>
    </input>
  </fieldset>

This just returns nothing.

Any help would be greatly appreciated.

Labels (1)
0 Karma

Taruchit
Contributor

Hi @sb01splunk,

I tried using your second code, but the value of token "ProjectName" as all_projects 

It does not take the query results in the dropdown. 

Can you please suggest how to resolve it?

Thank you
Taruchit

0 Karma

sandeepmakkena
Contributor
| inputlookup assets.csv | return ProjectCode | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode

Try this and also you can also try without the table part in your query. You don't have to use the table in a dropdown search.
Hope this helps. Thanks for the question.

0 Karma

dyapasrikanth
Path Finder

After looking into network logs in browser I figured it out like sort command is truncating the results to 10000 rows. May be I should avoid it as dropdown already having the filter option (autocomplete).

messages: [{type: "INFO", text: "The sort command is truncating output to 10000 rows"}]
preview: false
results: [{env_name: "mlcd1", count: "1"}, {env_name: "mlcd2", count: "1"}, {env_name: "mlct1", count: "1"},…]
0: {env_name: "mlcd1", count: "1"}
1: {env_name: "mlcd2", count: "1"}
2: {env_name: "mlct1", count: "1"}
3: {env_name: "mlct2", count: "1"}
4: {env_name: "np1", count: "1"}
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...