How do I populate a multivalue input with itself during a drilldown?

thisissplunk — Wed, 27 Jan 2016 20:10:32 GMT

I have a few inputs at the top of my dashboard, one being a multivalue input. Its default is two values, but I often only have one value in there to filter the result show I'd like.

I then click on a field value in a random panel that reloads the dashboard page with the new selected data filtering the entire dashboard. However, this resets the multivalue input back to default. This is not what I want. I've tried this and it places values into the multivalue input instead, but incorrectly so, returning no results:

 <link field="filename">
            <![CDATA[
              /app/Splunk_Files_App/filedata_dashboard?form.filename=$click.value2$&form.index=$index$&form.filetype=$filetype$
            ]]>
 </link>

The problem is the multivalue $filetype$. It literally populates it with "file_type=exe" when I drilldown instead of "EXE".
Here is the multivalue input if needed:

<input type="multiselect" token="filetype" searchWhenChanged="true">
  <label>File name</label>
  <choice value="*">All</choice>
  <default>EXE,PDF</default>
  <search>
    <query>index=$index$ sourcetype=file_data | dedup file_type | table file_type</query>
    <earliest>$time.earliest$</earliest>
    <latest>$time.latest$</latest>
  </search>
  <fieldForLabel>file_type</fieldForLabel>
  <fieldForValue>file_type</fieldForValue>
  <!--      Build multi-selection search: 
  EX: (sourcetype ="value1" OR sourcetype ="value2" OR ...)
  -->
  <prefix>(</prefix>
  <valuePrefix>file_type="</valuePrefix>
  <valueSuffix>"</valueSuffix>
  <delimiter> OR </delimiter>
  <suffix>)</suffix>
</input>

tldr: I try to populate a multivalue input with itself during a drilldown and it doesn't work as expected. How do I do this?

Re: How do I populate a multivalue input with itself during a drilldown?

somesoni2 — Wed, 27 Jan 2016 20:38:55 GMT

Try something like this (run anywhere example). See how the multiselect values are formatted (just with delimiter) and how they are used in the search (using subsearch to generate field=value1 OR field=value2... format)

<form>
  <label>Multiselect Dropdown</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="sourcetype" searchWhenChanged="true">
      <label>Source Types</label>
      <choice value="splunkd">splunkd</choice>
      <choice value="splunk_web_access">splunk_web_access</choice>
      <choice value="scheduler">scheduler</choice>
      <default>splunkd,splunk_web_access</default>
      <delimiter>,</delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Sourcetype Distribution</title>
        <search>
          <query>index=_internal [| gentimes start=-1 | eval sourcetype="$sourcetype$" | table sourcetype | makemv sourcetype delim="," | mvexpand sourcetype ]| timechart count by sourcetype</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>

        <option name="charting.legend.placement">right</option>
        <drilldown>
          <link>
            <![CDATA[
               /app/search/multiselect_dropdown?form.sourcetype=$click.name2$
             ]]>
          </link>
        </drilldown>        
      </chart>
    </panel>
  </row>
</form>

topic Re: How do I populate a multivalue input with itself during a drilldown? in Dashboards & Visualizations

How do I populate a multivalue input with itself during a drilldown?

Re: How do I populate a multivalue input with itself during a drilldown?