topic Re: Add hosts to Splunk multiselect UI in Getting Data In

Add hosts to Splunk multiselect UI

kirti_gupta12 — Thu, 09 Jan 2020 22:19:40 GMT

I want to populate the list of hosts in the multiselect input option in Splunk.

index=someIndexName * host!="notThis*" | stats values(host) as host

I can see the list of hosts getting populated in Splunk. However, they are not getting populated in multiselect list. It says "populating" and nothing shows up.

Re: Add hosts to Splunk multiselect UI

vnravikumar — Fri, 10 Jan 2020 03:27:11 GMT

Try like below

<form>
  <label>multiselect</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="field1">
      <label>field1</label>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <search>
        <query>index=_internal 
| stats count by host</query>
      </search>
    </input>
  </fieldset>
</form>