<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Tokens for multiselect inputs in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Tokens-for-multiselect-inputs/m-p/290812#M18450</link>
    <description>&lt;P&gt;I use "delimiter" instead , problem solved &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;</description>
    <pubDate>Wed, 22 Mar 2017 09:52:04 GMT</pubDate>
    <dc:creator>abovebeyond</dc:creator>
    <dc:date>2017-03-22T09:52:04Z</dc:date>
    <item>
      <title>Tokens for multiselect inputs</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Tokens-for-multiselect-inputs/m-p/290811#M18449</link>
      <description>&lt;P&gt;Hi, im trying to create a multiple select checkbox with parameters&lt;/P&gt;

&lt;P&gt;My checkbox looks like:&lt;/P&gt;

&lt;BLOCKQUOTE&gt;
&lt;PRE&gt;&lt;CODE&gt; &amp;lt;input type="checkbox" token="EventCode"&amp;gt;
      &amp;lt;label&amp;gt;Event Code:&amp;lt;/label&amp;gt;
      &amp;lt;choice value="'ERROR'"&amp;gt;ERROR&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="'Success'"&amp;gt;Success&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="'NoValue'"&amp;gt;NoValue&amp;lt;/choice&amp;gt;
      &amp;lt;default&amp;gt;'ERROR', 'NoValue'&amp;lt;/default&amp;gt;
      &amp;lt;valueSuffix&amp;gt;,&amp;lt;/valueSuffix&amp;gt;
   &amp;lt;/input&amp;gt; 
&lt;/CODE&gt;&lt;/PRE&gt;
&lt;/BLOCKQUOTE&gt;

&lt;P&gt;My search is a DBQEURY: &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; | dbquery "MYDB" "select * 
from [dbo].[Mytable]
where NotificationEventCode in ($EventCode$)
order by id desc"
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;While try to search my search looks like:&lt;BR /&gt;
"and NotificationEventCode in ('ERROR', 'NoValue',) &lt;/P&gt;

&lt;P&gt;How can i remove the "," in the end? &lt;/P&gt;

&lt;P&gt;Thanks!&lt;/P&gt;</description>
      <pubDate>Wed, 22 Mar 2017 09:18:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Tokens-for-multiselect-inputs/m-p/290811#M18449</guid>
      <dc:creator>abovebeyond</dc:creator>
      <dc:date>2017-03-22T09:18:47Z</dc:date>
    </item>
    <item>
      <title>Re: Tokens for multiselect inputs</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Tokens-for-multiselect-inputs/m-p/290812#M18450</link>
      <description>&lt;P&gt;I use "delimiter" instead , problem solved &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 22 Mar 2017 09:52:04 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Tokens-for-multiselect-inputs/m-p/290812#M18450</guid>
      <dc:creator>abovebeyond</dc:creator>
      <dc:date>2017-03-22T09:52:04Z</dc:date>
    </item>
  </channel>
</rss>

