Multiselect filter. Select all matches in classic dashboard.

[LIS]

Hi Splunkers :-),

We have nice feature it dashboard studio - "Select all matches" in multiselect filter.

But, unfortunately not in classic dashboard. 

Can we built similar logic in classic dashboard?

[yuanliu]

Classic UI does not have a provision to allow "select all choices" with one click.  But you can make an entry that has all choices.  Maintainability of such a code depends on how you populate this multivalue input.  It can be very easy if the input is populated by a search.  Just use appendpipe, like this

index=_internal
| stats count by group
| eval label = group
| appendpipe
    [stats values(group) as group
    | eval label = "All"]

In this example, I want an input that can select one or more values from field group.  For "normal" entries, label will be the same as group value.  But I use appendpipe to add a row with label "All".

Here is a complete example for you to play with and compare with real use case:

<form version="1.1" theme="dark">
  <label>"Select all choices"</label>
  <description>https://community.splunk.com/t5/Splunk-Search/Multiselect-filter-Select-all-matches-in-classic-dashboard/m-p/741079#M240547</description>
  <fieldset submitButton="false">
    <input type="multiselect" token="group_tok" searchWhenChanged="true">
      <label>Select groups</label>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>group</fieldForValue>
      <search>
        <query>index=_internal
| stats count by group
| eval label = group
| appendpipe
    [stats values(group) as group
    | eval label = "All"]</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <initialValue>bucket_metrics,cachemgr_bucket,conf,deploy-connections,deploy-server,dutycycle,executor,instance,kvstore_connections,map,mpool,parallel_reduce_metric,per_host_agg_cpu,per_host_lb_cpu,per_host_msp_cpu,per_host_thruput,per_index_agg_cpu,per_index_lb_cpu,per_index_msp_cpu,per_index_thruput,per_source_agg_cpu,per_source_lb_cpu,per_source_msp_cpu,per_source_thruput,per_sourcetype_agg_cpu,per_sourcetype_lb_cpu,per_sourcetype_msp_cpu,per_sourcetype_thruput,pipeline,pipelineset,queue,realtime_search_data,regex_cache,search_concurrency,search_health_metrics,search_pool,searchscheduler,spacemgr,subtask_seconds,tailingprocessor,telemetry_metrics_buffer,thruput,tpool,uihttp,version_control</initialValue>
      <delimiter> </delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal group IN ($group_tok$)
| stats count by group</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

If the multiple choices are static, the code will be harder to maintain because every time you add or delete an entry, you must add or delete from two places. (In this case, use of makeresults may help maintain sanity.)

Hope this helps.

[LIS]

Thanks @yuanliu , interesting option, but question not actually about that :-).

usually we use this easier option for this - choice called "All" using "*" as value

[yuanliu]

---

usually we use this easier option for this - choice called "All" using "*" as value

---

I understand the desire to use a simpler method.  However, as your this reply to @gcusello says, that option will not satisfy your use case which is to make sure all listed options are a match, not "any" as "*" would have done. ("*" should really be named "Any", not "All")

My solution, on the other hand, meets that requirement; it is functionally equivalent to Dashboard Studio's "Select all" mouse action.  If I am not mistaken, @woodcock's suggestion uses a similar concept except it populates an additional text box.

[LIS]

hi @yuanliu ,

I don't need select All in my classic dashboard

But I need select All Matches:

[yuanliu]

But I need select All Matches:

---

It's about time you explain exactly this sentence means.  Make sure you illustrate data, desired output based on illustrated data, and explain the use case without SPL.

[LIS]

hi @yuanliu For me it is straight forward ).

If you have multiselect filters in dashboard studio, please open it and check the feature which i shared in screenshot.

Then try to do the same in multiselect filter in classic dashboard :-). 

[yuanliu]

The "All" selection in the mock dashboard I posted earlier fulfills exactly the same functionality of "Select all" in Dashboard Studio.  You can make the "All" selection on top of the choice list.  As I explained the last time, Dashboard Classic (Simple XML) does not support "select all" via UI function.  If you want the user to have the capability to functionally do what "Select all" does, add the "All" selection like I suggested.  Otherwise, tell your users that they have to go manually select every choice. (Users may be used to the idea that "All" means "Any".  If that is a problem, you can make an "All" entry using semantics of "any" (*), then name the special selection I demonstrated something like "All match".)

[LIS]

1. I do filtering in muliselect filter
2. I have below in filter e.g. 27 matched values

3. I dont want click 27 times on each to select all of them

4. I want click one time on  "Select all matches" as it is in Studio to select all matched values.

5. OR hit enter to select.

[yuanliu]

---

3. I dont want click 27 times on each to select all of them

4. I want click one time on  "Select all matches" as it is in Studio to select all matched values.

Then, implement my sample code with the label "Select all matches".  It will not magically show checkmarks over 27 selections, but it will do exactly what 27 clicks will accomplish.

[LIS]

Hi @yuanliu , can you please check, what you suggested. IT is different from what i am looking for :-).

I have put your code and checked to be sure, maybe i missed something.

for example in filter try to select all values with "bundle".

So, we have four matched values. How can i select these four values by one click? 

[yuanliu]

Like I said above, there are a million ways to do this.  But you have to decide the exact behavior.  In the demo dashboard I posted, I used preselect.  You can edit the input to select these 4 as default selection.

An alternative behavior could be a special selection that has label "all 4" and the four values as value.  Implementation details will depend on how you use the token and so on.  There are other alternatives.  You need to be clear in describing how you want the UI to behave.

[LIS]

Hi @yuanliu ,  I think I was pretty clear).  I need the same functionality like in Studio  -  "Select matched" .

But, anyway thank you for your efforts.

[gcusello]

Hi @LIS ,

did you tried to add a static choice called "All" using "*" as value?

Ciao.

Giuseppe

[LIS]

hi @gcusello ,

I have it , but question different.  I want to select not all but all matched :-).

[gcusello]

Hi @LIS ,

are the values that you display in the multiselect from a search or are static?

if from a search, you display only the ones that match.

Ciao.

Giuseppe

[woodcock]

For this just add at text box to filter the multiselect inputs, and then select all of them.

[LIS]

hi @woodcock can you please point me to right direction )

[LIS]

Hi @woodcock , 

Thank you, can you elaborate please.

[LIS]

hi @gcusello ,

the values  in the multiselect from a search, but it doesnt matter.

i know that i display the ones that match :-).  

Let me bring more details:

1. I do filtering in muliselect filter
2. I have below in filter e.g. 27 matched values

3. I dont want click 27 times on each to select all of them

4. I want click one time on  "Select all matches" as it is in Studio to select all matched values.

5. OR hit enter to select.