<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to create a token that points to multiple values returned from dbquery? in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-token-that-points-to-multiple-values-returned/m-p/249842#M45158</link>
    <description>&lt;P&gt;In you second query (DEVICE_PREFIX) use makemv to create a multivalue field and use that in your final query. You may have to use &lt;CODE&gt;IN&lt;/CODE&gt; as opposed to &lt;CODE&gt;LIKE&lt;/CODE&gt; and massage the text some. Hopefully, this gets you started.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| dbquery "ROUTERDB" "SELECT DEVICE_PREFIX FROM LKP_LOCATION_EDITED WHERE METRO_CITY LIKE '%$METRO_CITY$%'"  |  stats values(DEVICE_PREFIX) AS DEVICE_PREFIX | makemv DEVICE_PREFIX delim=","  | table DEVICE_PREFIX
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;and in the final query, try using &lt;CODE&gt;IN&lt;/CODE&gt;&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| dbquery ROUTERDB  "select * from tbl_sample_stats WHERE ROUTER IN '%search_area%' " | table ROUTER 
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Sat, 09 Jul 2016 20:15:38 GMT</pubDate>
    <dc:creator>sundareshr</dc:creator>
    <dc:date>2016-07-09T20:15:38Z</dc:date>
    <item>
      <title>How to create a token that points to multiple values returned from dbquery?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-token-that-points-to-multiple-values-returned/m-p/249841#M45157</link>
      <description>&lt;P&gt;I created a drop-down that lists the METRO_CITY name. When selected, it will return multiple router name prefixes to get all routers in that city. How would I pipe all these router names that were returned into a token to be used in another dbquery in the following table?&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;  &amp;lt;input type="dropdown" token="METRO_CITY" searchWhenChanged="true"&amp;gt;
    &amp;lt;label&amp;gt;Select a location:&amp;lt;/label&amp;gt;
    &amp;lt;choice value="London"&amp;gt;london&amp;lt;/choice&amp;gt;
    &amp;lt;search&amp;gt;
      &amp;lt;query&amp;gt;| dbquery "ROUTERDB" "SELECT METRO_CITY FROM LKP_LOCATION_EDITED" | dedup METRO_CITY&amp;lt;/query&amp;gt;
    &amp;lt;/search&amp;gt;
   &amp;lt;default value="Miami (FL)"&amp;gt;Miami&amp;lt;/default&amp;gt;
    &amp;lt;fieldForLabel&amp;gt;METRO_CITY&amp;lt;/fieldForLabel&amp;gt;
    &amp;lt;fieldForValue&amp;gt;METRO_CITY&amp;lt;/fieldForValue&amp;gt;


    &amp;lt;change&amp;gt;
      &amp;lt;condition value="$METRO_CITY$"&amp;gt;
        &amp;lt;set token="search_area"&amp;gt;
          &amp;lt;search&amp;gt;
            &amp;lt;query&amp;gt;
              | dbquery "ROUTERDB" "SELECT DEVICE_PREFIX FROM LKP_LOCATION_EDITED WHERE METRO_CITY LIKE '%$METRO_CITY$%'" 
          &amp;lt;/query&amp;gt;
        &amp;lt;/search&amp;gt;
      &amp;lt;/set&amp;gt;
      &amp;lt;/condition&amp;gt;
    &amp;lt;/change&amp;gt;


  &amp;lt;/input&amp;gt;

  &amp;lt;table id="highlight"&amp;gt;
    &amp;lt;title&amp;gt;GWR&amp;lt;/title&amp;gt;
    &amp;lt;search&amp;gt;
      &amp;lt;query&amp;gt;| dbquery ROUTERDB  "select * from tbl_sample_stats WHERE ROUTER LIKE '%$search_area$%' " | table ROUTER &amp;lt;/query&amp;gt;
    &amp;lt;/search&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 08 Jul 2016 13:46:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-token-that-points-to-multiple-values-returned/m-p/249841#M45157</guid>
      <dc:creator>amandaxtru</dc:creator>
      <dc:date>2016-07-08T13:46:09Z</dc:date>
    </item>
    <item>
      <title>Re: How to create a token that points to multiple values returned from dbquery?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-token-that-points-to-multiple-values-returned/m-p/249842#M45158</link>
      <description>&lt;P&gt;In you second query (DEVICE_PREFIX) use makemv to create a multivalue field and use that in your final query. You may have to use &lt;CODE&gt;IN&lt;/CODE&gt; as opposed to &lt;CODE&gt;LIKE&lt;/CODE&gt; and massage the text some. Hopefully, this gets you started.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| dbquery "ROUTERDB" "SELECT DEVICE_PREFIX FROM LKP_LOCATION_EDITED WHERE METRO_CITY LIKE '%$METRO_CITY$%'"  |  stats values(DEVICE_PREFIX) AS DEVICE_PREFIX | makemv DEVICE_PREFIX delim=","  | table DEVICE_PREFIX
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;and in the final query, try using &lt;CODE&gt;IN&lt;/CODE&gt;&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| dbquery ROUTERDB  "select * from tbl_sample_stats WHERE ROUTER IN '%search_area%' " | table ROUTER 
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Sat, 09 Jul 2016 20:15:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-token-that-points-to-multiple-values-returned/m-p/249842#M45158</guid>
      <dc:creator>sundareshr</dc:creator>
      <dc:date>2016-07-09T20:15:38Z</dc:date>
    </item>
    <item>
      <title>Re: How to create a token that points to multiple values returned from dbquery?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-token-that-points-to-multiple-values-returned/m-p/249843#M45159</link>
      <description>&lt;P&gt;The first query you gave me returns multiple router names separated by a space. e.g. router1 router2 router3&lt;BR /&gt;
For the second query, how does that translate into the '%search_area%'?&lt;BR /&gt;
Because the keyword IN is usually done like WHERE ROUTER IN ('router1' router2'... etc);&lt;BR /&gt;
What I mean to ask is how does the IN keyword work with the token $search_area$ and the "%" wildcard?&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 10:11:23 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-token-that-points-to-multiple-values-returned/m-p/249843#M45159</guid>
      <dc:creator>amandaxtru</dc:creator>
      <dc:date>2020-09-29T10:11:23Z</dc:date>
    </item>
    <item>
      <title>Re: How to create a token that points to multiple values returned from dbquery?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-token-that-points-to-multiple-values-returned/m-p/249844#M45160</link>
      <description>&lt;P&gt;Hmm, wonder why the &lt;CODE&gt;delim&lt;/CODE&gt; is not working. Try this instead.&lt;/P&gt;

&lt;P&gt;For DEVICE_PREFIX, use this query&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| dbquery "ROUTERDB" "SELECT DEVICE_PREFIX FROM LKP_LOCATION_EDITED WHERE METRO_CITY LIKE '%$METRO_CITY$%'"  |  stats count by DEVICE_PREFIX | fields - count | rename DEVICE_PREFIX AS ROUTER  |  format
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;and in the final query&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| dbquery ROUTERDB  "select * from tbl_sample_stats WHERE $search_area$"  | table ROUTER
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Mon, 11 Jul 2016 20:53:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-token-that-points-to-multiple-values-returned/m-p/249844#M45160</guid>
      <dc:creator>sundareshr</dc:creator>
      <dc:date>2016-07-11T20:53:46Z</dc:date>
    </item>
    <item>
      <title>Re: How to create a token that points to multiple values returned from dbquery?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-token-that-points-to-multiple-values-returned/m-p/249845#M45161</link>
      <description>&lt;P&gt;Another question... The router prefix needs a wildcard character to find all of the routers with the prefix.&lt;BR /&gt;
The query returns something like    ( ( ROUTER="PHIL" ) OR ( ROUTER="PHL02" ) OR ( ROUTER="PHL23" ))&lt;BR /&gt;
but I need it to be ((ROUTER LIKE 'PHIL%') OR (ROUTER LIKE 'PHL02%') OR (ROUTER LIKE 'PHL23%')).&lt;BR /&gt;
How would I go about this? Also thanks for the help!!! :')  &lt;/P&gt;</description>
      <pubDate>Tue, 12 Jul 2016 20:10:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-token-that-points-to-multiple-values-returned/m-p/249845#M45161</guid>
      <dc:creator>amandaxtru</dc:creator>
      <dc:date>2016-07-12T20:10:26Z</dc:date>
    </item>
    <item>
      <title>Re: How to create a token that points to multiple values returned from dbquery?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-token-that-points-to-multiple-values-returned/m-p/249846#M45162</link>
      <description>&lt;P&gt;Try replacing the string, like this&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;  | dbquery "ROUTERDB" "SELECT DEVICE_PREFIX FROM LKP_LOCATION_EDITED WHERE METRO_CITY LIKE '%$METRO_CITY$%'" | stats count by DEVICE_PREFIX | fields - count | rename DEVICE_PREFIX AS ROUTER  | format |eval search=replace(search, "=", " LIKE ")
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 13 Jul 2016 16:19:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-token-that-points-to-multiple-values-returned/m-p/249846#M45162</guid>
      <dc:creator>sundareshr</dc:creator>
      <dc:date>2016-07-13T16:19:14Z</dc:date>
    </item>
    <item>
      <title>Re: How to create a token that points to multiple values returned from dbquery?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-token-that-points-to-multiple-values-returned/m-p/249847#M45163</link>
      <description>&lt;P&gt;Thanks so much!!! &lt;/P&gt;</description>
      <pubDate>Wed, 13 Jul 2016 18:27:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-token-that-points-to-multiple-values-returned/m-p/249847#M45163</guid>
      <dc:creator>amandaxtru</dc:creator>
      <dc:date>2016-07-13T18:27:46Z</dc:date>
    </item>
  </channel>
</rss>

