Splunk® Enterprise

Splunk Dashboard Studio

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Multiselect

Use the multiselect input to let users select multiple options from a dropdown menu. Use the dropdown input type to let users make a single selection. You can populate multiselect inputs using either static values or dynamically by using search results. You can add up to, and including, 1,000 options to the multiselect menu.

The only supported multiselect input delimiter is the comma, so use the IN operator and format your queries appropriately, for example: index=_internal sourcetype IN ($ms2$) | table _time, user, sourcetype

The following options are available to use in the multiselect input options field:

  • defaultValue
  • token
  • items
  • clearDefaultOnSelection
  • selectFirstSearchResult
    • When a search generates the dropdown content, this sets the default value as the first search result returned.

Multiselect defaults

When you add a multiselect input, the value for defaultValue automatically sets.

Setting clearDefaultOnSelection to true clears the default selection when you interact with the input and select a value. Only your selected value remains.

Setting clearDefaultOnSelection to false persists the default value and keeps your selected value.

Multiselect example

In the following example, there are two multiselect inputs. One uses only static values and one that has a menu populated by search results.

A dashboard with three multiselect inputs.

Expand this window to copy/paste the dashboard definition into your own dashboard.

{
	"visualizations": {
		"viz_gMr0oNmO": {
			"type": "splunk.line",
			"title": "Line Chart with Dynamic Input",
			"dataSources": {
				"primary": "ds_2A3Efw25"
			},
			"description": "index=_internal _sourcetype IN ($token1$) | timechart count by _sourcetype"
		},
		"viz_dObiuubP": {
			"type": "splunk.line",
			"title": "Line chart with Static Input",
			"dataSources": {
				"primary": "ds_quzxE8AQ"
			},
			"description": "index=_internal user IN ($token2$) | timechart count by user"
		}
	},
	"dataSources": {
		"ds_search1": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal \n| stats count by sourcetype",
				"queryParameters": {
					"earliest": "-60m@m",
					"latest": "now"
				}
			},
			"name": "Search_1"
		},
		"ds_2A3Efw25": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal _sourcetype IN ($dd1$)\n| timechart count by _sourcetype",
				"queryParameters": {
					"earliest": "-60m@m",
					"latest": "now"
				}
			},
			"name": "Search_2"
		},
		"ds_quzxE8AQ": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal user IN ($dd2$)\n| timechart count by user",
				"queryParameters": {
					"earliest": "-60m@m",
					"latest": "now"
				}
			},
			"name": "Search_3"
		}
	},
	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},
	"inputs": {
		"input_ovnr6KpF": {
			"type": "input.multiselect",
			"options": {
				"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
				"token": "dd1",
				"defaultValue": "*"
			},
			"dataSources": {
				"primary": "ds_search1"
			},
			"title": "Dynamic Input - Select Sourcetype",
			"context": {
				"formattedConfig": {
					"number": {
						"prefix": ""
					}
				},
				"formattedStatics": ">statics | formatByType(formattedConfig)",
				"statics": [
					[
						"All"
					],
					[
						"*"
					]
				],
				"label": ">primary | seriesByName(\"sourcetype\") | renameSeries(\"label\") | formatByType(formattedConfig)",
				"value": ">primary | seriesByName(\"sourcetype\") | renameSeries(\"value\") | formatByType(formattedConfig)"
			}
		},
		"input_9MxBqEwU": {
			"type": "input.multiselect",
			"options": {
				"items": [
					{
						"label": "All",
						"value": "*"
					},
					{
						"label": "Administrators",
						"value": "admin"
					},
					{
						"label": "Splunkers",
						"value": "splunk-system-user"
					}
				],
				"token": "dd2",
				"defaultValue": "*"
			},
			"dataSources": {},
			"title": "Static Input - Select User"
		}
	},
	"layout": {
		"type": "grid",
		"options": {},
		"structure": [
			{
				"item": "viz_dObiuubP",
				"type": "block",
				"position": {
					"x": 0,
					"y": 342,
					"w": 1200,
					"h": 349
				}
			},
			{
				"item": "viz_gMr0oNmO",
				"type": "block",
				"position": {
					"x": 0,
					"y": 0,
					"w": 1200,
					"h": 342
				}
			}
		],
		"globalInputs": [
			"input_ovnr6KpF",
			"input_9MxBqEwU"
		]
	},
	"title": "Example — Multiselect Input"
}

Last modified on 06 June, 2023
PREVIOUS
Dropdown
  NEXT
Text box

This documentation applies to the following versions of Splunk® Enterprise: 9.0.0, 9.0.1, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.1.0, 9.1.1, 9.1.2, 9.0.2, 9.1.3, 9.2.0


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters