topic Using input from a multi-select input field for possible entries in a dropdown input field? in Dashboards & Visualizations

Using input from a multi-select input field for possible entries in a dropdown input field?

belle501 — Wed, 22 Nov 2017 11:56:00 GMT

Hi everyone,

Maybe it's weird what I'm trying to do, but I wanted to know if I could use the input from a multi-select input field as input options for a single input dropdown field.

Basically I want the selected entries from this multi-select input field:

to show up in the entry list of this dropdown input field:

In the dropdown field I only want to be able to select one of the servers that already has been selected in the multi-select field.

Code of the multi-select field:

<input type="multiselect" token="vm">
      <label>Machine</label>
      <fieldForLabel>name</fieldForLabel>
      <fieldForValue>name</fieldForValue>
      <search>
        <query>| savedsearch PAT_machines_search
               | search company="$company$" operational_status=$opstatus$ os=$os$
        </query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <valueSuffix>*</valueSuffix>
      <delimiter> OR </delimiter>
    </input>

Code of the dropdown field so far:

<row id="linux_input">
    <panel depends="$linux_patches$">
      <input type="dropdown" token="linux_server">
        <label>Linux Server</label>
        <fieldForLabel>linux_selected_server</fieldForLabel>
        <fieldForValue>linux_selected_server</fieldForValue>
        <search>
          <query>
            blabla placeholder
          </query>
        </search>
      </input>
    </panel>
  </row>

Anybody know if this is possible? Thanks!

Re: Using input from a multi-select input field for possible entries in a dropdown input field?

kamlesh_vaghela — Wed, 22 Nov 2017 12:18:48 GMT

Can you please check below xml?

<form>
  <label>multi-select input field for  dropdown input field</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="vm">
      <label>Machine</label>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_internal * | stats count by sourcetype </query>
        <earliest>-1h@h</earliest>
        <latest>now</latest>
      </search>
      <delimiter> ,</delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$vm$</title>
      <input type="dropdown" token="vm1">
        <label>My Machine</label>
        <fieldForLabel>sourcetype</fieldForLabel>
        <fieldForValue>sourcetype</fieldForValue>
        <search>
          <query>| makeresults | eval sourcetype="$vm$" | eval sourcetype=split(sourcetype,",") | mvexpand sourcetype | table sourcetype</query>
        </search>
      </input>
    </panel>
  </row>
</form>

Re: Using input from a multi-select input field for possible entries in a dropdown input field?

belle501 — Wed, 22 Nov 2017 12:45:34 GMT

Thanks, will try it out!

Re: Using input from a multi-select input field for possible entries in a dropdown input field?

belle501 — Tue, 29 Sep 2020 16:55:34 GMT

Alright, I have it implemented now, but I'm running into some issues. The dropdown correctly shows the servers but whenever I select one, the panels which depend on it won't load. They come up with errors like these:

The limit has been reached for log messages in info.csv. 137 messages have not been written to info.csv. Please refer to search.log for these messages or limits.conf to configure this limit.

[suct2v701] command.mvexpand: output will be truncated at 108700 results due to excessive memory usage. Memory threshold of 500MB as configured in limits.conf / [mvexpand] / max_mem_usage_mb has been reached.

Re: Using input from a multi-select input field for possible entries in a dropdown input field?

kamlesh_vaghela — Wed, 22 Nov 2017 13:36:51 GMT

Can you please share value from panel title?

<title>$vm$</title>

Can you please let me know how many results return from multiselect search?

Thanks

Re: Using input from a multi-select input field for possible entries in a dropdown input field?

belle501 — Wed, 22 Nov 2017 22:45:16 GMT

Hmm, I'm not sure I follow, what would you like to see?

This is how it looks now:

https://www.dropbox.com/s/l7s7umhi45jxtm6/Knipsel.JPG?dl=0

https://www.dropbox.com/s/tw7ley27764l9uw/Knipsel2.JPG?dl=0

Re: Using input from a multi-select input field for possible entries in a dropdown input field?

niketn — Wed, 22 Nov 2017 23:17:25 GMT

@kamlesh_vaghela, you missed accounting for Multi-value Token Delimiter and Suffix while extracting the selected values as single values for the dropdown.

@belle501, please try out the code for dropdown as below. Also for the dropdown token $vm1$ make sure token value is prefixed/suffixed properly before either in the dropdown properties or else during the search.

  <fieldset>
    <input type="multiselect" token="vm">
      <label>Machine</label>
      <fieldForLabel>name</fieldForLabel>
      <fieldForValue>name</fieldForValue>
      <search>
         <query>| savedsearch PAT_machines_search
                | search company="$company$" operational_status=$opstatus$ os=$os$
         </query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <valueSuffix>*</valueSuffix>
      <delimiter> OR </delimiter>
    </input>
    <input type="dropdown" token="linux_server">
      <label>Linux Server</label>
      <fieldForLabel>linux_selected_server</fieldForLabel>
      <fieldForValue>linux_selected_server</fieldForValue>
      <search>
        <query>| makeresults
| eval linux_selected_server=rtrim(replace("$vm$"," OR ",""),"*")
| eval linux_selected_server=split(linux_selected_server,"*")
| mvexpand linux_selected_server
| fields - _time</query>
      </search>
    </input>
  </fieldset>

If the above does not work please share the Search code in Simple XML where you are using the dropdown selected token value.

Re: Using input from a multi-select input field for possible entries in a dropdown input field?

kamlesh_vaghela — Thu, 23 Nov 2017 06:42:14 GMT

HI
Have you changed delimiter?

<delimiter> ,</delimiter>

This screenshot shows OR delimiter.

https://www.dropbox.com/s/tw7ley27764l9uw/Knipsel2.JPG?dl=0

Re: Using input from a multi-select input field for possible entries in a dropdown input field?

belle501 — Thu, 23 Nov 2017 10:02:26 GMT

Hi kamlesh, yes I had to change this part of your code:

 <form>
   <label>multi-select input field for  dropdown input field</label>
   <fieldset submitButton="false">
     <input type="multiselect" token="vm">
       <label>Machine</label>
       <fieldForLabel>sourcetype</fieldForLabel>
       <fieldForValue>sourcetype</fieldForValue>
       <search>
         <query>index=_internal * | stats count by sourcetype </query>
         <earliest>-1h@h</earliest>
         <latest>now</latest>
       </search>
       <delimiter> ,</delimiter>
     </input>
   </fieldset>

Because otherwise I couldn't select any machine in the multi-select field, and the dashboard would not load.

Re: Using input from a multi-select input field for possible entries in a dropdown input field?

belle501 — Thu, 23 Nov 2017 10:23:40 GMT

Hi niketnilay, thanks for your anwser. The dropdown field works correctly, but my panels keep giving errors saying that mvexpand is causing excessive memory usage.

Re: Using input from a multi-select input field for possible entries in a dropdown input field?

kamlesh_vaghela — Thu, 23 Nov 2017 12:06:06 GMT

ooh,

Ok, then we'll continue with OR the delimiter. I have revised my search due to mvexpand is causing excessive memory usage.

Can you please try this one?

<form>
  <label>multi-select input field for possible entries in a dropdown input field</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="vm">
      <label>Machine</label>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_internal * | stats count by sourcetype </query>
        <earliest>-1h@h</earliest>
        <latest>now</latest>
      </search>
      <delimiter> OR </delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$vm$</title>
      <input type="dropdown" token="vm1">
        <label>My Machine</label>
        <fieldForLabel>sourcetype</fieldForLabel>
        <fieldForValue>sourcetype</fieldForValue>
        <search>
          <query>| makeresults | eval sourcetype="$vm$" | eval sourcetype=split(sourcetype," OR ") | stats count by sourcetype | table sourcetype</query>
        </search>
      </input>
    </panel>
  </row>
</form>

Thanks

Re: Using input from a multi-select input field for possible entries in a dropdown input field?

belle501 — Thu, 23 Nov 2017 12:53:12 GMT

It works so far! 🙂 I edited the dropdown code a bit, this is what I ended up with:

<row id="linux_input">
    <panel depends="$linux_patches$">
      <input type="dropdown" token="vm1" searchWhenChanged="true">
        <label>Linux Server</label>
          <fieldForLabel>linux_selected_server</fieldForLabel>
          <fieldForValue>linux_selected_server</fieldForValue>
          <search>
            <query>| makeresults 
                   | eval linux_selected_server="$vm$" 
                   | eval linux_selected_server=replace("$vm$", "\*", "")
                   | eval linux_selected_server=split(linux_selected_server," OR ") 
                   | stats count by linux_selected_server 
                   | table linux_selected_server
            </query>
          </search>
        </input>
    </panel>
  </row>

Re: Using input from a multi-select input field for possible entries in a dropdown input field?

kamlesh_vaghela — Thu, 23 Nov 2017 13:41:29 GMT

Hi @belle501,

Glad to help you.

Can you please accept the answer to close the question and upvote my comments which helped you.

Happy Splunking

Re: Using input from a multi-select input field for possible entries in a dropdown input field?

belle501 — Thu, 23 Nov 2017 13:43:09 GMT

Will do! 🙂