https://community.splunk.com/t5/Dashboards-Visualizations/Could-create-search-message-in-multiselect-filter/m-p/700525#M57438 <P>Hi</P><P>you haven't add any SPL for query there.</P><P>You could check and use Splunk Dashboard example app <A href="https://splunkbase.splunk.com/app/1603" target="_blank">https://splunkbase.splunk.com/app/1603</A>&nbsp;for creating your own dashboards.</P><LI-CODE lang="markup"> &lt;input type="multiselect" token="sourcetype_token" searchWhenChanged="true"&gt; &lt;default&gt;splunkd, splunk_web_service, splunkd_access&lt;/default&gt; &lt;!-- The final value will be surrounded by prefix and suffix --&gt; &lt;prefix&gt;(&lt;/prefix&gt; &lt;suffix&gt;)&lt;/suffix&gt; &lt;!-- Each value will be surrounded by the valuePrefix and valueSuffix --&gt; &lt;valuePrefix&gt;sourcetype="&lt;/valuePrefix&gt; &lt;valueSuffix&gt;"&lt;/valueSuffix&gt; &lt;!-- All the values and their valuePrefix and valueSuffix will be concatenated together with the delimiter between them --&gt; &lt;delimiter&gt; OR &lt;/delimiter&gt; &lt;choice value="*"&gt;ALL&lt;/choice&gt; &lt;fieldForLabel&gt;sourcetype&lt;/fieldForLabel&gt; &lt;fieldForValue&gt;sourcetype&lt;/fieldForValue&gt; &lt;search&gt; &lt;query&gt;index=_internal | stats count by sourcetype&lt;/query&gt; &lt;earliest&gt;0&lt;/earliest&gt; &lt;/search&gt; &lt;/input&gt;</LI-CODE><P>Just add/modify &lt;search&gt;&lt;query&gt;....&lt;/query&gt;&lt;/search&gt; part into your form.</P><P>r. Ismo</P> Mon, 30 Sep 2024 11:44:12 GMT isoutamo 2024-09-30T11:44:12Z https://community.splunk.com/t5/Dashboards-Visualizations/Could-create-search-message-in-multiselect-filter/m-p/700524#M57437 <P>I am getting error "could not create search". How to fix this error ?<BR /><BR /></P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="gemrose_0-1727695353081.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32868i213A961D41DBDBD2/image-size/medium?v=v2&amp;px=400" role="button" title="gemrose_0-1727695353081.png" alt="gemrose_0-1727695353081.png" /></span></P> <P>xml::</P> <LI-CODE lang="markup">&lt;input type="multiselect" token="environment"&gt; &lt;label&gt;Environments&lt;/label&gt; &lt;choice value="cfp08"&gt;p08&lt;/choice&gt; &lt;choice value="cfp07"&gt;p07&lt;/choice&gt; &lt;choice value="*"&gt;ALL&lt;/choice&gt; &lt;default&gt;*&lt;/default&gt; &lt;valuePrefix&gt;environment =&lt;/valuePrefix&gt; &lt;delimiter&gt; OR &lt;/delimiter&gt; &lt;search&gt; &lt;query/&gt; &lt;/search&gt; &lt;fieldForLabel&gt;environment&lt;/fieldForLabel&gt; &lt;fieldForValue&gt;environment&lt;/fieldForValue&gt; &lt;/input&gt;</LI-CODE> Mon, 30 Sep 2024 14:12:42 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Could-create-search-message-in-multiselect-filter/m-p/700524#M57437 gemrose 2024-09-30T14:12:42Z https://community.splunk.com/t5/Dashboards-Visualizations/Could-create-search-message-in-multiselect-filter/m-p/700525#M57438 <P>Hi</P><P>you haven't add any SPL for query there.</P><P>You could check and use Splunk Dashboard example app <A href="https://splunkbase.splunk.com/app/1603" target="_blank">https://splunkbase.splunk.com/app/1603</A>&nbsp;for creating your own dashboards.</P><LI-CODE lang="markup"> &lt;input type="multiselect" token="sourcetype_token" searchWhenChanged="true"&gt; &lt;default&gt;splunkd, splunk_web_service, splunkd_access&lt;/default&gt; &lt;!-- The final value will be surrounded by prefix and suffix --&gt; &lt;prefix&gt;(&lt;/prefix&gt; &lt;suffix&gt;)&lt;/suffix&gt; &lt;!-- Each value will be surrounded by the valuePrefix and valueSuffix --&gt; &lt;valuePrefix&gt;sourcetype="&lt;/valuePrefix&gt; &lt;valueSuffix&gt;"&lt;/valueSuffix&gt; &lt;!-- All the values and their valuePrefix and valueSuffix will be concatenated together with the delimiter between them --&gt; &lt;delimiter&gt; OR &lt;/delimiter&gt; &lt;choice value="*"&gt;ALL&lt;/choice&gt; &lt;fieldForLabel&gt;sourcetype&lt;/fieldForLabel&gt; &lt;fieldForValue&gt;sourcetype&lt;/fieldForValue&gt; &lt;search&gt; &lt;query&gt;index=_internal | stats count by sourcetype&lt;/query&gt; &lt;earliest&gt;0&lt;/earliest&gt; &lt;/search&gt; &lt;/input&gt;</LI-CODE><P>Just add/modify &lt;search&gt;&lt;query&gt;....&lt;/query&gt;&lt;/search&gt; part into your form.</P><P>r. Ismo</P> Mon, 30 Sep 2024 11:44:12 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Could-create-search-message-in-multiselect-filter/m-p/700525#M57438 isoutamo 2024-09-30T11:44:12Z