topic Re: Count selected items in Multiselect in Splunk Enterprise

Count selected items in Multiselect

dataisbeautiful — Wed, 19 Jun 2024 11:46:37 GMT

Hi all

I'm trying to count the number of selected items in a Multiselect control. I've tried eval and stats but no luck with either 😞

| eval selected_total = count($element$)

| stats count($element$) as selected_total

Thanks

Re: Count selected items in Multiselect

ITWhisperer — Wed, 19 Jun 2024 11:37:35 GMT

Try something like this

| eval selected_total = mvcount($form.element$)

Re: Count selected items in Multiselect

dataisbeautiful — Wed, 19 Jun 2024 11:46:15 GMT

Hi @ITWhisperer

That didn't work unfortunately, gave the following error

Set token value to render visualization $form.element$

Re: Count selected items in Multiselect

ITWhisperer — Wed, 19 Jun 2024 11:56:54 GMT

Please provide more information such as the source of your dashboard

Re: Count selected items in Multiselect

dataisbeautiful — Thu, 20 Jun 2024 13:28:45 GMT

Sample dashboard

{ "visualizations": { "viz_3hKq7uoX": { "type": "splunk.singlevalue", "options": {}, "dataSources": { "primary": "ds_a2mWNgri" } }, "viz_JUFcFWVl": { "type": "splunk.singlevalue", "options": {}, "dataSources": { "primary": "ds_LbaP4o2H" } } }, "dataSources": { "ds_a2mWNgri": { "type": "ds.search", "options": { "query": "| makeresults\n| eval selected_total = count($element$)\n| table selected_total" }, "name": "Search_eval" }, "ds_LbaP4o2H": { "type": "ds.search", "options": { "query": "| makeresults\n| stats count($element$) as selected_total\n| table selected_total" }, "name": "Search_stats" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-24h@h,now" }, "title": "Global Time Range" }, "input_QDGCxYVt": { "options": { "items": [ { "label": "Apple", "value": "a" }, { "label": "Banana", "value": "b" }, { "label": "Coconut", "value": "c" }, { "label": "Dragonfruit", "value": "d" }, { "label": "Elderberry", "value": "e" }, { "label": "Fig", "value": "f" }, { "label": "Grape", "value": "g" } ], "token": "element" }, "title": "Select something", "type": "input.multiselect" } }, "layout": { "type": "absolute", "options": { "width": 1440, "height": 960, "display": "auto" }, "structure": [ { "item": "viz_3hKq7uoX", "type": "block", "position": { "x": 20, "y": 20, "w": 250, "h": 250 } }, { "item": "viz_JUFcFWVl", "type": "block", "position": { "x": 290, "y": 20, "w": 250, "h": 250 } } ], "globalInputs": [ "input_global_trp", "input_QDGCxYVt" ] }, "description": "test", "title": "test" }

Re: Count selected items in Multiselect

ITWhisperer — Thu, 20 Jun 2024 17:01:45 GMT

Can you build your dashboard in SimpleXML / Classic (as token management is a little better there)?

Re: Count selected items in Multiselect

dataisbeautiful — Mon, 24 Jun 2024 13:19:50 GMT

Here's a sample in classic, still can't figure out how to count the number of selected items.

<form version="1.1" theme="light"> <label>test2</label> <fieldset submitButton="false"> <input type="multiselect" token="element" searchWhenChanged="true"> <label>Fruit Select</label> <choice value="a">Apple</choice> <choice value="b">Banana</choice> <choice value="c">Coconut</choice> <choice value="d">Dragonfruit</choice> <choice value="e">Elderberry</choice> <choice value="f">Fig</choice> <choice value="g">Grape</choice> </input> </fieldset> <row> <panel> <single> <title>Number of selected fruit</title> <search> <query>| makeresults | stats count($element$) as selected_total | table selected_total</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="refresh.display">progressbar</option> </single> </panel> </row> </form>

Re: Count selected items in Multiselect

bowesmana — Tue, 25 Jun 2024 00:49:12 GMT

As @ITWhisperer , you should use $form.element$ - the $form.element$ variant of the token is the one that holds the values of the selections, whereas the base $element$ holds the final full expanded token with all the prefixes, suffixed and delimiter, see your slightly modified example.

<form version="1.1" theme="light"> <label>test2</label> <fieldset submitButton="false"> <input type="multiselect" token="element" searchWhenChanged="true"> <label>Fruit Select</label> <choice value="a">Apple</choice> <choice value="b">Banana</choice> <choice value="c">Coconut</choice> <choice value="d">Dragonfruit</choice> <choice value="e">Elderberry</choice> <choice value="f">Fig</choice> <choice value="g">Grape</choice> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter>, </delimiter> </input> </fieldset> <row> <panel> <title>Form element::$form.element$, Element::$element$</title> <single> <title>Number of selected fruit</title> <search> <query>| makeresults | eval selected_total=mvcount(split($form.element|s$,",")) | table selected_total</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="refresh.display">progressbar</option> </single> </panel> </row> </form>

I am not sure if the| eval selected_total=mvcount(split($form.element|s$,",")) would work also in dashboard studio also.

Re: Count selected items in Multiselect

bowesmana — Tue, 25 Jun 2024 02:06:38 GMT

And you can also add a <change> element in the multiselect, which although officially unsupported, does work, i.e. this

<change> <eval token="selections">mvcount($form.element$)</eval> </change>

Note that you don't need the split here as the $form.element$ is only flattened in the token assignment in the SPL

Re: Count selected items in Multiselect

dataisbeautiful — Tue, 25 Jun 2024 07:26:24 GMT

Thanks @bowesmana @ITWhisperer