topic Re: How use multiselect to pass multiple selected values to second drop down and to dashboard panels (Pivots and charts) in Dashboards & Visualizations

How use multiselect to pass multiple selected values to second drop down and to dashboard panels (Pivots and charts)

sanjeevt — Fri, 19 May 2017 19:19:30 GMT

I have two multi select drop downs. When I select one or more from first drop down, the second drop down should populate accordingly and at the same time need to pass values to Pivots and charts of dashboard panels.

When I select more than one item form first multiselect I see 'search produced no results'

Please someone give me an idea. My code looks like as below

Dynamic Multi Select Support

<input type="time" token="time_token">
  <label>Select Time Range</label>
  <default>
    <earliest>-15m</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="multiselect" token="selected_host" searchWhenChanged="true">
  <label>Select the Host</label>
  <search>
    <query>index=temptesting_007 | stats count by host | sort limit=100 host</query>
    <earliest>-7d@h</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>host</fieldForLabel>
  <fieldForValue>host</fieldForValue>
  <delimiter> , </delimiter>
</input>
<input type="multiselect" token="source_type" searchWhenChanged="false">
  <label>Select Log Type</label>
  <search>
    <query>index=temptesting_007 host= $selected_host$ | stats count by sourcetype | sort limit=100 sourcetype</query>
    <earliest>0</earliest>
    <latest></latest>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>sourcetype</fieldForValue>
  <delimiter>,</delimiter>
  <choice value="*">ALL</choice>
</input>


<panel>
  <single>
    <search>
      <query>| pivot My_Model_2 My_Root_Search_Object count(My_Root_Search_Object) AS "Count of Logs"  FILTER host in ($selected_host$) FILTER sourcetype in ($source_type$) ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1</query>
      <earliest>$time_token.earliest$</earliest>
      <latest>$time_token.latest$</latest>
    </search>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="numberPrecision">0</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="unitPosition">after</option>
    <option name="useColors">0</option>
    <option name="useThousandSeparators">1</option>
    <option name="linkView">search</option>
    <option name="list.drilldown">full</option>
    <option name="list.wrap">1</option>
    <option name="maxLines">5</option>
    <option name="raw.drilldown">full</option>
    <option name="rowNumbers">0</option>
    <option name="table.drilldown">all</option>
    <option name="table.wrap">1</option>
    <option name="type">list</option>
    <fields>["host","source","sourcetype"]</fields>
    <option name="drilldown">none</option>
  </single>
</panel>
<panel>
  <table>
    <search>
      <query>| pivot My_Model_2 My_Root_Search_Object count(My_Root_Search_Object) AS "Count of My Root Search Object" SPLITROW host AS Host SPLITROW sourcetype AS "Source Type" FILTER host in ($selected_host$) FILTER sourcetype in ($source_type$) SORT 100 host ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1</query>
      <earliest>$time_token.earliest$</earliest>
      <latest>$time_token.latest$</latest>
    </search>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
    <option name="count">10</option>
  </table>
</panel>

Re: How use multiselect to pass multiple selected values to second drop down and to dashboard panels (Pivots and charts)

lguinn2 — Mon, 22 May 2017 05:11:10 GMT

The syntax in line 22 is wrong. If you have selected "hostA" and "hostB" in the first multiselect, the query in line 22 becomes

index=temptesting_007 host= hostA , hostB | stats count by sourcetype | sort limit=100 sourcetype

Starting with Splunk 6.6, you can use the following syntax:

index=temptesting_007 host IN ( $selected_host$ ) | stats count by sourcetype | sort limit=100 sourcetype

Re: How use multiselect to pass multiple selected values to second drop down and to dashboard panels (Pivots and charts)

sanjeevt — Tue, 23 May 2017 18:28:50 GMT

Thank you . It worked

Re: How use multiselect to pass multiple selected values to second drop down and to dashboard panels (Pivots and charts)

rjthibod — Tue, 23 May 2017 18:57:10 GMT

hey @lguinn, when did the search format <FIELD> IN (...) get introduced for base searches? That is new to me.

Re: How use multiselect to pass multiple selected values to second drop down and to dashboard panels (Pivots and charts)

rjthibod — Tue, 23 May 2017 19:02:15 GMT

Nevermind, I found the note in the SPL docs for the search command. Looks like it is new to 6.6. That is super helpful.

Re: How use multiselect to pass multiple selected values to second drop down and to dashboard panels (Pivots and charts)

rjthibod — Tue, 23 May 2017 19:16:15 GMT

Please "Accept" the other answer and change this thread to a comment. You currently have it posted as an answer.

Re: How use multiselect to pass multiple selected values to second drop down and to dashboard panels (Pivots and charts)

skoelpin — Thu, 30 Nov 2017 04:39:28 GMT

This works perfectly for me, thanks @lguinn !

Re: How use multiselect to pass multiple selected values to second drop down and to dashboard panels (Pivots and charts)

maxiveil — Wed, 04 May 2022 17:29:05 GMT

Make sure to write "IN" in capital letters otherwise it won't work.

Re: How use multiselect to pass multiple selected values to second drop down and to dashboard panels (Pivots and charts)

paritoshs24 — Sat, 18 Jun 2022 21:19:41 GMT

Dude !!!!! Your answer saved my life !! 😘