<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Multiple values on a static value for a Dashboard Multiselect field in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Multiple-values-on-a-static-value-for-a-Dashboard-Multiselect/m-p/558965#M38847</link>
    <description>&lt;P&gt;Hello,&lt;/P&gt;&lt;P&gt;I would like to have a Multiselect field on a dashboard and want to add options to group values on the drop down list.&lt;/P&gt;&lt;P&gt;For example, I want to have options options like:&lt;BR /&gt;All states&lt;BR /&gt;Western states&lt;BR /&gt;Eastern states&lt;BR /&gt;AL&lt;BR /&gt;AK&lt;BR /&gt;...&lt;/P&gt;&lt;P&gt;where I want to define "Western states" as CA or OR or WA.&lt;BR /&gt;Can you illustrate the proper syntax then for this option so when "Western states" is selected, it would do an OR on CA or OR or WA? Thank you.&lt;/P&gt;&lt;P&gt;&amp;lt;choice value="CA ???????"&amp;gt;Western states&amp;lt;/choice&amp;gt;&lt;/P&gt;&lt;P&gt;&lt;BR /&gt;Code:&lt;BR /&gt;&amp;lt;input type="multiselect" token="state" searchWhenChanged="true"&amp;gt;&lt;BR /&gt;&amp;lt;label&amp;gt;States&amp;lt;/label&amp;gt;&lt;BR /&gt;&amp;lt;fieldForLabel&amp;gt;stcode&amp;lt;/fieldForLabel&amp;gt;&lt;BR /&gt;&amp;lt;fieldForValue&amp;gt;stcode&amp;lt;/fieldForValue&amp;gt;&lt;BR /&gt;&amp;lt;search&amp;gt;&lt;BR /&gt;&amp;lt;query&amp;gt;|inputlookup somelookup | dedup stcode | sort stcode&amp;lt;/query&amp;gt;&lt;BR /&gt;&amp;lt;earliest&amp;gt;$field1.earliest$&amp;lt;/earliest&amp;gt;&lt;BR /&gt;&amp;lt;latest&amp;gt;$field1.latest$&amp;lt;/latest&amp;gt;&lt;BR /&gt;&amp;lt;/search&amp;gt;&lt;BR /&gt;&amp;lt;valuePrefix&amp;gt;stcode="&amp;lt;/valuePrefix&amp;gt;&lt;BR /&gt;&amp;lt;valueSuffix&amp;gt;"&amp;lt;/valueSuffix&amp;gt;&lt;BR /&gt;&amp;lt;delimiter&amp;gt; OR &amp;lt;/delimiter&amp;gt;&lt;BR /&gt;&amp;lt;choice value="*"&amp;gt;All states&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="CA ???????"&amp;gt;Western states&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;/input&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Sun, 11 Jul 2021 04:53:44 GMT</pubDate>
    <dc:creator>molehu</dc:creator>
    <dc:date>2021-07-11T04:53:44Z</dc:date>
    <item>
      <title>Multiple values on a static value for a Dashboard Multiselect field</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Multiple-values-on-a-static-value-for-a-Dashboard-Multiselect/m-p/558965#M38847</link>
      <description>&lt;P&gt;Hello,&lt;/P&gt;&lt;P&gt;I would like to have a Multiselect field on a dashboard and want to add options to group values on the drop down list.&lt;/P&gt;&lt;P&gt;For example, I want to have options options like:&lt;BR /&gt;All states&lt;BR /&gt;Western states&lt;BR /&gt;Eastern states&lt;BR /&gt;AL&lt;BR /&gt;AK&lt;BR /&gt;...&lt;/P&gt;&lt;P&gt;where I want to define "Western states" as CA or OR or WA.&lt;BR /&gt;Can you illustrate the proper syntax then for this option so when "Western states" is selected, it would do an OR on CA or OR or WA? Thank you.&lt;/P&gt;&lt;P&gt;&amp;lt;choice value="CA ???????"&amp;gt;Western states&amp;lt;/choice&amp;gt;&lt;/P&gt;&lt;P&gt;&lt;BR /&gt;Code:&lt;BR /&gt;&amp;lt;input type="multiselect" token="state" searchWhenChanged="true"&amp;gt;&lt;BR /&gt;&amp;lt;label&amp;gt;States&amp;lt;/label&amp;gt;&lt;BR /&gt;&amp;lt;fieldForLabel&amp;gt;stcode&amp;lt;/fieldForLabel&amp;gt;&lt;BR /&gt;&amp;lt;fieldForValue&amp;gt;stcode&amp;lt;/fieldForValue&amp;gt;&lt;BR /&gt;&amp;lt;search&amp;gt;&lt;BR /&gt;&amp;lt;query&amp;gt;|inputlookup somelookup | dedup stcode | sort stcode&amp;lt;/query&amp;gt;&lt;BR /&gt;&amp;lt;earliest&amp;gt;$field1.earliest$&amp;lt;/earliest&amp;gt;&lt;BR /&gt;&amp;lt;latest&amp;gt;$field1.latest$&amp;lt;/latest&amp;gt;&lt;BR /&gt;&amp;lt;/search&amp;gt;&lt;BR /&gt;&amp;lt;valuePrefix&amp;gt;stcode="&amp;lt;/valuePrefix&amp;gt;&lt;BR /&gt;&amp;lt;valueSuffix&amp;gt;"&amp;lt;/valueSuffix&amp;gt;&lt;BR /&gt;&amp;lt;delimiter&amp;gt; OR &amp;lt;/delimiter&amp;gt;&lt;BR /&gt;&amp;lt;choice value="*"&amp;gt;All states&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="CA ???????"&amp;gt;Western states&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;/input&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Sun, 11 Jul 2021 04:53:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Multiple-values-on-a-static-value-for-a-Dashboard-Multiselect/m-p/558965#M38847</guid>
      <dc:creator>molehu</dc:creator>
      <dc:date>2021-07-11T04:53:44Z</dc:date>
    </item>
    <item>
      <title>Re: Multiple values on a static value for a Dashboard Multiselect field</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Multiple-values-on-a-static-value-for-a-Dashboard-Multiselect/m-p/558967#M38848</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/131241"&gt;@molehu&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Can you please try this sample code?&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;form&amp;gt;
  &amp;lt;label&amp;gt;Stcode Multiselect&amp;lt;/label&amp;gt;
  &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| makeresults | eval selected_state="$form.state$",stcode=split(selected_state,",")| mvexpand stcode | fields stcode | format | table search&amp;lt;/query&amp;gt;
          &amp;lt;done&amp;gt;
            &amp;lt;set token="selected_state"&amp;gt;$result.search$&amp;lt;/set&amp;gt;
          &amp;lt;/done&amp;gt;
        &amp;lt;/search&amp;gt;
  &amp;lt;fieldset submitButton="false"&amp;gt;
    &amp;lt;input type="multiselect" token="state"&amp;gt;
      &amp;lt;label&amp;gt;field1&amp;lt;/label&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;stcode&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;stcode&amp;lt;/fieldForValue&amp;gt;
      &amp;lt;search&amp;gt;
        &amp;lt;query&amp;gt;| makeresults | eval _raw="stcode
AL
AK
CA
OR
WA" | multikv forceheader=1 | fields stcode&amp;lt;/query&amp;gt;
        &amp;lt;earliest&amp;gt;-24h@h&amp;lt;/earliest&amp;gt;
        &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
      &amp;lt;/search&amp;gt;
      &amp;lt;choice value="*"&amp;gt;All states&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="CA,OR,WA"&amp;gt;Western states&amp;lt;/choice&amp;gt;
    &amp;lt;/input&amp;gt;
  &amp;lt;/fieldset&amp;gt;
  &amp;lt;row&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;html&amp;gt;
        $selected_state$
      &amp;lt;/html&amp;gt;
    &amp;lt;/panel&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| makeresults | eval _raw="stcode
AL
AK
CA
OR
WA" | multikv forceheader=1 | search  $selected_state$&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;-24h@h&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
          &amp;lt;sampleRatio&amp;gt;1&amp;lt;/sampleRatio&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;option name="count"&amp;gt;100&amp;lt;/option&amp;gt;
        &amp;lt;option name="dataOverlayMode"&amp;gt;none&amp;lt;/option&amp;gt;
        &amp;lt;option name="drilldown"&amp;gt;none&amp;lt;/option&amp;gt;
        &amp;lt;option name="percentagesRow"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="rowNumbers"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="totalsRow"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="wrap"&amp;gt;true&amp;lt;/option&amp;gt;
      &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
  &amp;lt;/row&amp;gt;
&amp;lt;/form&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thanks&lt;BR /&gt;KV&lt;BR /&gt;▄︻̷̿┻̿═━一&lt;BR /&gt;&lt;BR /&gt;If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.&lt;/P&gt;</description>
      <pubDate>Sun, 11 Jul 2021 05:22:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Multiple-values-on-a-static-value-for-a-Dashboard-Multiselect/m-p/558967#M38848</guid>
      <dc:creator>kamlesh_vaghela</dc:creator>
      <dc:date>2021-07-11T05:22:55Z</dc:date>
    </item>
  </channel>
</rss>

