All Apps and Add-ons

Multiselect pulldown, selecting default values

aadye
Explorer

I have three linked pulldowns, the first one is a regular pulldown and the other two are mutiselects. My problem is that the last pulldown is not populating as it requires a default value for it's search, they include a "All" value, but until it is selected it does not populate as it's value is "" and not "*", how can I select "All"?

My code is below:



<!-- Copyright (C) 2010-2011 Sideview LLC. All Rights Reserved. -->




*
2
False


<![CDATA[source="/reportdata.csv" | search h_region!="h_region" h_building!="h_building" h_name!="h_name"]]>

<module name="Pulldown">
  <param name="float"></param>
  <param name="name">h_region</param>
  <param name="label">Region</param>

  <param name="postProcess">dedup h_region | sort h_region</param>
  <param name="searchFieldsToDisplay">
    <list>
      <param name="label">region</param>
      <param name="value">h_region</param>
    </list>
  </param>

  <module name="Pulldown">
    <param name="float"></param>
    <param name="size">5</param>
    <param name="name">h_building</param>
    <param name="label">Building</param> 
    <param name="separator">+OR+</param>
    <param name="postProcess">search h_region="$h_region$" | sort h_building | dedup h_building</param>
    <param name="staticFieldsToDisplay">
  <list>
    <param name="label">All</param>
    <param name="value">*</param>
      </list>
     </param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="label">h_building</param>
        <param name="value">h_building</param>
      </list>
    </param>


  <module name="Pulldown">
    <param name="float"></param>
    <param name="size">5</param>
    <param name="name">h_name</param>
    <param name="label">Host</param>
    <param name="postProcess">search h_region="$h_region$" h_building="$h_building$" | sort h_name | dedup h_name</param>
    <param name="separator">+OR+</param>
    <param name="staticFieldsToDisplay">
  <list>
    <param name="label">All</param>
    <param name="value">*</param>
      </list>
     </param>
    <param name="searchFieldsToDisplay">
      <list>

        <param name="label">h_name</param>
        <param name="value">h_name</param>

      </list>
    </param>



  </module>
  </module>
</module>



1 Solution

sideview
SplunkTrust
SplunkTrust

Great question. Sorry I haven't answered it until now, but I've been quietly chewing on it.

I can treat this as a bug and have it fixed in a future release. It's a somewhat interesting issue, and how to fix the issue without introducing a bunch more issues is also interesting, but any writeup I've tried of it sounds terribly dull and pedantic so I'll spare you.

To be very brief, a Pulldown selecting itself to "" amounts to selecting itself to a null value, having seen a null value from upstream. However there are in general always null values from upstream therefore selecting itself to All/"" like this would result in it constantly resetting itself to All/"" which would be obviously annoying. Hm. OK that was less pedantic.

I'm afraid for now there's no workaround, but I'll try and get it fixed in the next release.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Great question. Sorry I haven't answered it until now, but I've been quietly chewing on it.

I can treat this as a bug and have it fixed in a future release. It's a somewhat interesting issue, and how to fix the issue without introducing a bunch more issues is also interesting, but any writeup I've tried of it sounds terribly dull and pedantic so I'll spare you.

To be very brief, a Pulldown selecting itself to "" amounts to selecting itself to a null value, having seen a null value from upstream. However there are in general always null values from upstream therefore selecting itself to All/"" like this would result in it constantly resetting itself to All/"" which would be obviously annoying. Hm. OK that was less pedantic.

I'm afraid for now there's no workaround, but I'll try and get it fixed in the next release.

sideview
SplunkTrust
SplunkTrust

This was fixed as a bug and the general behavior of multiselect Pulldowns that do have an "all/*" entry was improved at some point in Sideview Utils 2.X. It seems to have not made it into the release notes but it did happen.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...