Multiselect
Use the multiselect input to let users select multiple options from a dropdown menu. Use the dropdown input type to let users make a single selection. You can populate multiselect inputs using either static values or dynamically by using search results. You can add up to, and including, 1,000 options to the multiselect menu.
The only supported multiselect input delimiter is the comma, so use the IN
operator and format your queries appropriately, for example:
index=_internal sourcetype IN ($ms2$) | table _time, user, sourcetype
The following options are available to use in the multiselect input options field:
- defaultValue
- token
- items
- clearDefaultOnSelection
- selectFirstSearchResult
- When a search generates the dropdown content, this sets the default value as the first search result returned.
Apply token filters to multiselect values
Apply token filters to your tokens to correctly capture the value of a token. For example, if your multiselect values include spaces, this will break your Splunk Search Processing Language (SPL) unless you use the token filter $token|s$
, which wraps values in quotations and helps with token usage in SPL. For more details, see Token filters.
Multiselect defaults
When you add a multiselect input, the value for defaultValue
automatically sets.
Setting clearDefaultOnSelection
to true
clears the default selection when you interact with the input and select a value. Only your selected value remains.
Setting clearDefaultOnSelection
to false
persists the default value and keeps your selected value.
Multiselect example
In the following example, there are two multiselect inputs. One uses only static values and one that has a menu populated by search results.
Expand this window to copy/paste the dashboard definition into your own dashboard.
{ "visualizations": { "viz_gMr0oNmO": { "type": "splunk.line", "title": "Line Chart with Dynamic Input", "dataSources": { "primary": "ds_2A3Efw25" }, "description": "index=_internal _sourcetype IN ($token1$) | timechart count by _sourcetype" }, "viz_dObiuubP": { "type": "splunk.line", "title": "Line chart with Static Input", "dataSources": { "primary": "ds_quzxE8AQ" }, "description": "index=_internal user IN ($token2$) | timechart count by user" } }, "dataSources": { "ds_search1": { "type": "ds.search", "options": { "query": "index=_internal \n| stats count by sourcetype", "queryParameters": { "earliest": "-60m@m", "latest": "now" } }, "name": "Search_1" }, "ds_2A3Efw25": { "type": "ds.search", "options": { "query": "index=_internal _sourcetype IN ($dd1$)\n| timechart count by _sourcetype", "queryParameters": { "earliest": "-60m@m", "latest": "now" } }, "name": "Search_2" }, "ds_quzxE8AQ": { "type": "ds.search", "options": { "query": "index=_internal user IN ($dd2$)\n| timechart count by user", "queryParameters": { "earliest": "-60m@m", "latest": "now" } }, "name": "Search_3" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_ovnr6KpF": { "type": "input.multiselect", "options": { "items": ">frame(label, value) | prepend(formattedStatics) | objects()", "token": "dd1", "defaultValue": "*" }, "dataSources": { "primary": "ds_search1" }, "title": "Dynamic Input - Select Sourcetype", "context": { "formattedConfig": { "number": { "prefix": "" } }, "formattedStatics": ">statics | formatByType(formattedConfig)", "statics": [ [ "All" ], [ "*" ] ], "label": ">primary | seriesByName(\"sourcetype\") | renameSeries(\"label\") | formatByType(formattedConfig)", "value": ">primary | seriesByName(\"sourcetype\") | renameSeries(\"value\") | formatByType(formattedConfig)" } }, "input_9MxBqEwU": { "type": "input.multiselect", "options": { "items": [ { "label": "All", "value": "*" }, { "label": "Administrators", "value": "admin" }, { "label": "Splunkers", "value": "splunk-system-user" } ], "token": "dd2", "defaultValue": "*" }, "dataSources": {}, "title": "Static Input - Select User" } }, "layout": { "tabs": { "items": [ { "layoutId": "layout_1", "label": "New tab" } ] }, "layoutDefinitions": { "layout_1": { "type": "grid", "structure": [ { "item": "viz_dObiuubP", "type": "block", "position": { "x": 0, "y": 342, "w": 1200, "h": 349 } }, { "item": "viz_gMr0oNmO", "type": "block", "position": { "x": 0, "y": 0, "w": 1200, "h": 342 } } ] } }, "globalInputs": [ "input_ovnr6KpF", "input_9MxBqEwU" ] }, "title": "Example — Multiselect Input" }
Dropdown | Text box |
This documentation applies to the following versions of Splunk Cloud Platform™: 9.2.2406 (latest FedRAMP release), 9.3.2408
Feedback submitted, thanks!