Have you tried turning JSON pretty print off? ... View more

Bingo! That was my problem was well: had pretty print on, which meant each event took up multiple lines. Turning pretty print off fixed the default syntax highlighting. Thanks for the tip 🙂 ... View more

I know this thread is super old, but this is the only thing that came up when I was looking for an answer for the same problem. It turned out I had JSON pretty print on, so an event took up multiple lines. Once I turned pretty print off and each event took exactly one line, syntax highlighting was back on by default. ... View more

I missed your reply somehow. Can you post your code for "Multiselect2"? ... View more

Instead of unsetting Multiselect2, can you set it to a default value? ... View more

I see what the problem is now. The downside of custom JS code is that Splunk could change the structure of its elements under the hood and break your code, which is what happened here. Looks like Splunk 8.x changed some things under the hood. Not only is the "input-multiselect" class gone (which broke my original code that worked for any number of multi-selects), the id that you specified is now appended with a number (which breaks the new single multi-select code). Try this code and see if it works: require([ 'splunkjs/mvc', 'splunkjs/mvc/simplexml/ready!' ], function(mvc) { function setupMultiInput(instance_id) { // Get multiselect var multi = mvc.Components.get(instance_id); // On change, check selection multi.on("change", (selectedValues) => { if (selectedValues.length > 1 && selectedValues.includes("*")) { var indexOfAll = selectedValues.indexOf("*"); // If "ALL" was selected before current (more specific) selection, remove it from list if (indexOfAll == 0) { selectedValues.splice(indexOfAll, 1); multi.val(selectedValues); multi.render(); } else { // "ALL" was selected last, clear input and leave only "ALL" in it multi.val("*"); multi.render(); } } }); } var all_multi_selects = document.getElementsByClassName("splunk-multidropdown"); for (j = 0; j < all_multi_selects.length; j++) { setupMultiInput(all_multi_selects[j].id); } }); ... View more

If you use inspect elements in your browser's developer tools (in Chrome, it's View ->Developer->Inspect Elements) and select your multi-select, it should look something like this: <div id="my_multiselect_id" data-cid="view14086" class="input input-multiselect" data-view="views/dashboard/form/Input" data-render-time="0.01"> Are you seeing that, or something else? What version of Splunk are you using? ... View more

Keep in mind that with the code snippet as shown, your "All" label must have a value of "*****", otherwise it will not work. Please check to make sure that is the case in your code. ... View more

Is there any reason why you only want it to work on a single multiselect? Usually people want this to be the default behavior for all multiselects on the page. In any case, you can replace this: var all_multi_selects = document.getElementsByClassName("input-multiselect"); for (j = 0; j < all_multi_selects.length; j++) { setupMultiInput(all_multi_selects[j].id); } With: var this_one_multiselect = document.getElementById("my_multiselect_id"); setupMultiInput(this_one_multiselect); Where your multiselect has the id of "my_multiselect_id". ... View more

I'm looking for a solution to the same issue. I actually do have a Submit button, which when pressed does update the URL. However, I'd like for users to not have to go through this extra step. Do you mind sharing your code for your solution? ... View more

tonyca, checkout my answer below. Should do what you want. ... View more

I was not able to get either of the above answers to work for me in Splunk 6.6.1, so I wrote my own using plain Javascript without the need for jQuery. This is also a generic solution that works for any number of multi-selects on the page. require([ 'splunkjs/mvc', 'splunkjs/mvc/simplexml/ready!' ], function(mvc) { function setupMultiInput(instance_id) { // Get multiselect var multi = mvc.Components.get(instance_id); // On change, check selection multi.on("change", (selectedValues) => { if (selectedValues.length > 1 && selectedValues.includes("*")) { var indexOfAll = selectedValues.indexOf("*"); // If "ALL" was selected before current (more specific) selection, remove it from list if (indexOfAll == 0) { selectedValues.splice(indexOfAll, 1); multi.val(selectedValues); multi.render(); } else { // "ALL" was selected last, clear input and leave only "ALL" in it multi.val("*"); multi.render(); } } }); } var all_multi_selects = document.getElementsByClassName("input-multiselect"); for (j = 0; j < all_multi_selects.length; j++) { setupMultiInput(all_multi_selects[j].id); } }); The assumption is that the default value is "*". But you can easily modify the code if you use something different for the default value. Then all you have to do is to include the script at the top of your dashboard code: <form script="path/to/multiselect.js"> ... View more

@ashleyherbert, is your code still working for you? I tried (for several hours) to get it to work in Splunk 6.6.1 and was not able to. With your code as shown, the multi-select input doesn't allow me to remove the default "All" choice, nor does it allow me to add any additional choices. ... View more