topic Re: How to have multiple values in a token in Dashboards & Visualizations

How to have multiple values in a token

bryceweb22 — Mon, 01 Jul 2019 15:36:02 GMT

I am looking for a way to have my token in a multiselect dropdown pass two values into the search to increase the chances of generating more accurate results, please help.

Thanks!

Re: How to have multiple values in a token

vnravikumar — Mon, 01 Jul 2019 15:57:35 GMT

Check this sample

<form>
  <label>multiselect</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="field1">
      <label>field1</label>
      <valuePrefix>method="</valuePrefix>
      <delimiter> OR </delimiter>
      <valueSuffix>"</valueSuffix>
      <fieldForLabel>method</fieldForLabel>
      <fieldForValue>method</fieldForValue>
      <search>
        <query>index="_internal" sourcetype=splunkd_ui_access |stats count by method</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index="_internal" $field1$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Re: How to have multiple values in a token

bryceweb22 — Mon, 01 Jul 2019 16:20:01 GMT

Okay so I added the OR in the delimiter but where do I add my second value at because I tried doing it after the first one and no results were found.

Re: How to have multiple values in a token

vnravikumar — Mon, 01 Jul 2019 16:26:48 GMT

You need to consider these

 <valuePrefix>method="</valuePrefix>
       <delimiter> OR </delimiter>
       <valueSuffix>"</valueSuffix>

Finally, it constructed as index="_internal" method="DELETE" OR method="HEAD"

Re: How to have multiple values in a token

bryceweb22 — Mon, 01 Jul 2019 17:59:14 GMT

Okay well I need it to be like this example

ModuleId=490 OR LevelId=70