Multiselect

Use the multiselect input to let users select multiple options from a dropdown menu. Use the dropdown input type to let users make a single selection. You can populate multiselect inputs using either static values or dynamically by using search results. You can add up to, and including, 1,000 options to the multiselect menu.

The only supported multiselect input delimiter is the comma, so use the IN operator and format your queries appropriately, for example: index=_internal sourcetype IN ($ms2$) | table _time, user, sourcetype

The following options are available to use in the multiselect input options field:

• defaultValue
• token
• items
• clearDefaultOnSelection
• selectFirstSearchResult
  • When a search generates the dropdown content, this sets the default value as the first search result returned.

Apply token filters to multiselect values

Apply token filters to your tokens to correctly capture the value of a token. For example, if your multiselect values include spaces, this will break your Splunk Search Processing Language (SPL) unless you use the token filter $token|s$, which wraps values in quotations and helps with token usage in SPL. For more details, see Token filters.

Multiselect defaults

When you add a multiselect input, the value for defaultValue automatically sets.

Setting clearDefaultOnSelection to true clears the default selection when you interact with the input and select a value. Only your selected value remains.

Setting clearDefaultOnSelection to false persists the default value and keeps your selected value.

Multiselect example

In the following example, there are two multiselect inputs. One uses only static values and one that has a menu populated by search results.

Expand this window to copy/paste the dashboard definition into your own dashboard.

{
	"visualizations": {
		"viz_gMr0oNmO": {
			"type": "splunk.line",
			"title": "Line Chart with Dynamic Input",
			"dataSources": {
				"primary": "ds_2A3Efw25"
			},
			"description": "index=_internal _sourcetype IN ($token1$) | timechart count by _sourcetype"
		},
		"viz_dObiuubP": {
			"type": "splunk.line",
			"title": "Line chart with Static Input",
			"dataSources": {
				"primary": "ds_quzxE8AQ"
			},
			"description": "index=_internal user IN ($token2$) | timechart count by user"
		}
	},
	"dataSources": {
		"ds_search1": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal \n| stats count by sourcetype",
				"queryParameters": {
					"earliest": "-60m@m",
					"latest": "now"
				}
			},
			"name": "Search_1"
		},
		"ds_2A3Efw25": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal _sourcetype IN ($dd1$)\n| timechart count by _sourcetype",
				"queryParameters": {
					"earliest": "-60m@m",
					"latest": "now"
				}
			},
			"name": "Search_2"
		},
		"ds_quzxE8AQ": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal user IN ($dd2$)\n| timechart count by user",
				"queryParameters": {
					"earliest": "-60m@m",
					"latest": "now"
				}
			},
			"name": "Search_3"
		}
	},
	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},
	"inputs": {
		"input_ovnr6KpF": {
			"type": "input.multiselect",
			"options": {
				"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
				"token": "dd1",
				"defaultValue": "*"
			},
			"dataSources": {
				"primary": "ds_search1"
			},
			"title": "Dynamic Input - Select Sourcetype",
			"context": {
				"formattedConfig": {
					"number": {
						"prefix": ""
					}
				},
				"formattedStatics": ">statics | formatByType(formattedConfig)",
				"statics": [
					[
						"All"
					],
					[
						"*"
					]
				],
				"label": ">primary | seriesByName(\"sourcetype\") | renameSeries(\"label\") | formatByType(formattedConfig)",
				"value": ">primary | seriesByName(\"sourcetype\") | renameSeries(\"value\") | formatByType(formattedConfig)"
			}
		},
		"input_9MxBqEwU": {
			"type": "input.multiselect",
			"options": {
				"items": [
					{
						"label": "All",
						"value": "*"
					},
					{
						"label": "Administrators",
						"value": "admin"
					},
					{
						"label": "Splunkers",
						"value": "splunk-system-user"
					}
				],
				"token": "dd2",
				"defaultValue": "*"
			},
			"dataSources": {},
			"title": "Static Input - Select User"
		}
	},
	"layout": {
		"type": "grid",
		"options": {},
		"structure": [
			{
				"item": "viz_dObiuubP",
				"type": "block",
				"position": {
					"x": 0,
					"y": 342,
					"w": 1200,
					"h": 349
				}
			},
			{
				"item": "viz_gMr0oNmO",
				"type": "block",
				"position": {
					"x": 0,
					"y": 0,
					"w": 1200,
					"h": 342
				}
			}
		],
		"globalInputs": [
			"input_ovnr6KpF",
			"input_9MxBqEwU"
		]
	},
	"title": "Example — Multiselect Input"
}