<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Use token in IN-Clause in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Use-token-in-IN-Clause/m-p/454999#M29843</link>
    <description>&lt;P&gt;@danielsuter,&lt;/P&gt;

&lt;P&gt;Is the dropdown populated by dynamic search or static values ? How do you represent value for "All" ? &lt;/P&gt;

&lt;P&gt;If they are static, would this work ? &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;    &amp;lt;input type="dropdown" token="service"&amp;gt;
      &amp;lt;label&amp;gt;Terms&amp;lt;/label&amp;gt;
      &amp;lt;choice value="&amp;amp;quot;A&amp;amp;quot;, &amp;amp;quot;B&amp;amp;quot;,&amp;amp;quot;C&amp;amp;quot;"&amp;gt;All&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="&amp;amp;quot;here comes one term&amp;amp;quot;"&amp;gt;One term desc&amp;lt;/choice&amp;gt;
    &amp;lt;/input&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Fri, 22 Mar 2019 15:11:28 GMT</pubDate>
    <dc:creator>renjith_nair</dc:creator>
    <dc:date>2019-03-22T15:11:28Z</dc:date>
    <item>
      <title>Use token in IN-Clause</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Use-token-in-IN-Clause/m-p/454998#M29842</link>
      <description>&lt;P&gt;I'm using a where field in ("term1", "term2") clause in a search. The terms should come from a token but I'm having troubles to do that. The search never fires or I get syntax problems.&lt;/P&gt;

&lt;P&gt;I have a single select drop down from which the values for the in clause are coming:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;input type="dropdown" token="service"&amp;gt;
  &amp;lt;label&amp;gt;Some label&amp;lt;/label&amp;gt;
  &amp;lt;choice value="here come multiple terms"&amp;gt;All&amp;lt;/choice&amp;gt;
  &amp;lt;choice value="here comes one term"&amp;gt;One term desc&amp;lt;/choice&amp;gt;
&amp;lt;/input&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Now I want to use it in my search clause&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;        | where service_field in($service$)
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 22 Mar 2019 15:01:03 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Use-token-in-IN-Clause/m-p/454998#M29842</guid>
      <dc:creator>danielsuter</dc:creator>
      <dc:date>2019-03-22T15:01:03Z</dc:date>
    </item>
    <item>
      <title>Re: Use token in IN-Clause</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Use-token-in-IN-Clause/m-p/454999#M29843</link>
      <description>&lt;P&gt;@danielsuter,&lt;/P&gt;

&lt;P&gt;Is the dropdown populated by dynamic search or static values ? How do you represent value for "All" ? &lt;/P&gt;

&lt;P&gt;If they are static, would this work ? &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;    &amp;lt;input type="dropdown" token="service"&amp;gt;
      &amp;lt;label&amp;gt;Terms&amp;lt;/label&amp;gt;
      &amp;lt;choice value="&amp;amp;quot;A&amp;amp;quot;, &amp;amp;quot;B&amp;amp;quot;,&amp;amp;quot;C&amp;amp;quot;"&amp;gt;All&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="&amp;amp;quot;here comes one term&amp;amp;quot;"&amp;gt;One term desc&amp;lt;/choice&amp;gt;
    &amp;lt;/input&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 22 Mar 2019 15:11:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Use-token-in-IN-Clause/m-p/454999#M29843</guid>
      <dc:creator>renjith_nair</dc:creator>
      <dc:date>2019-03-22T15:11:28Z</dc:date>
    </item>
    <item>
      <title>Re: Use token in IN-Clause</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Use-token-in-IN-Clause/m-p/455000#M29844</link>
      <description>&lt;P&gt;The value list in &lt;CODE&gt;in&lt;/CODE&gt;function is a comma separated quoted strings. Make sure your dropdown is formatting it that way.&lt;/P&gt;</description>
      <pubDate>Fri, 22 Mar 2019 15:12:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Use-token-in-IN-Clause/m-p/455000#M29844</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2019-03-22T15:12:47Z</dc:date>
    </item>
  </channel>
</rss>

