<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Sum columns selected from a dropdown menu in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Sum-columns-selected-from-a-dropdown-menu/m-p/702215#M57596</link>
    <description>&lt;P&gt;Hi Ravi,&lt;/P&gt;&lt;P&gt;The strategy is to configure your multivalue input with using prefix, sufix and delimiter, like this:&lt;/P&gt;&lt;P&gt;&amp;lt;fieldset submitButton="false"&amp;gt;&lt;BR /&gt;&amp;lt;input type="multiselect" token="field1"&amp;gt;&lt;BR /&gt;&amp;lt;label&amp;gt;field1&amp;lt;/label&amp;gt;&lt;BR /&gt;&amp;lt;choice value="value1"&amp;gt;value1&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="value2"&amp;gt;value2&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="value3"&amp;gt;value3&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;delimiter&amp;gt;,&amp;lt;/delimiter&amp;gt;&lt;BR /&gt;&amp;lt;prefix&amp;gt;| stats sum(&amp;lt;/prefix&amp;gt;&lt;BR /&gt;&amp;lt;suffix&amp;gt;)&amp;lt;/suffix&amp;gt;&lt;BR /&gt;&amp;lt;/input&amp;gt;&lt;BR /&gt;&amp;lt;/fieldset&amp;gt;&lt;/P&gt;&lt;P&gt;Via UI it will look like this:&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2024-10-17 161730.png" style="width: 504px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/33134i2F0A4337ED94CA2F/image-size/large?v=v2&amp;amp;px=999" role="button" title="Screenshot 2024-10-17 161730.png" alt="Screenshot 2024-10-17 161730.png" /&gt;&lt;span class="lia-inline-image-caption" onclick="event.preventDefault();"&gt;Screenshot 2024-10-17 161730.png&lt;/span&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;So in your search you'll simply do:&lt;/P&gt;&lt;P&gt;|makeresults $field1$&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;where |makeresults is your actual search. The token will append | sum(&amp;lt;selected_values&amp;gt;)&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Then you can add the proper grouping fields and etc to make that happen as you want it to. (like add the "&lt;SPAN&gt;as Total by Jobname" after the ")" suffix&lt;/SPAN&gt;&lt;/P&gt;</description>
    <pubDate>Thu, 17 Oct 2024 19:19:22 GMT</pubDate>
    <dc:creator>victor_menezes</dc:creator>
    <dc:date>2024-10-17T19:19:22Z</dc:date>
    <item>
      <title>Sum columns selected from a dropdown menu</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Sum-columns-selected-from-a-dropdown-menu/m-p/702212#M57595</link>
      <description>&lt;P&gt;I have a multi select drop down menu with field names as values.&amp;nbsp; &amp;nbsp;&lt;/P&gt;
&lt;P&gt;When i one or mone values from the drop down menu, those fields/columns need to totaled.&lt;/P&gt;
&lt;P&gt;I tried the below code as sugged by Meta AI..But it is not producing any result. Please help me&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;&amp;lt;dashboard&amp;gt;
  &amp;lt;label&amp;gt;Sum Selected Fields&amp;lt;/label&amp;gt;
  &amp;lt;row&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;input type="dropdown" token="selected_fields"&amp;gt;
        &amp;lt;label&amp;gt;Select Fields&amp;lt;/label&amp;gt;
        &amp;lt;choice value="field1"&amp;gt;Field 1&amp;lt;/choice&amp;gt;
        &amp;lt;choice value="field2"&amp;gt;Field 2&amp;lt;/choice&amp;gt;
        &amp;lt;choice value="field3"&amp;gt;Field 3&amp;lt;/choice&amp;gt;
      &amp;lt;/input&amp;gt;
      &amp;lt;chart&amp;gt;
        &amp;lt;search&amp;gt;

          | eval sum_fields="$selected_fields$"
          | stats sum(eval(split(sum_fields, ","))) as Total by Jobname
        &amp;lt;/search&amp;gt;
      &amp;lt;/chart&amp;gt;
    &amp;lt;/panel&amp;gt;
  &amp;lt;/row&amp;gt;
&amp;lt;/dashboard&amp;gt;&lt;/LI-CODE&gt;</description>
      <pubDate>Thu, 17 Oct 2024 19:31:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Sum-columns-selected-from-a-dropdown-menu/m-p/702212#M57595</guid>
      <dc:creator>ravikumar_sri20</dc:creator>
      <dc:date>2024-10-17T19:31:50Z</dc:date>
    </item>
    <item>
      <title>Re: Sum columns selected from a dropdown menu</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Sum-columns-selected-from-a-dropdown-menu/m-p/702215#M57596</link>
      <description>&lt;P&gt;Hi Ravi,&lt;/P&gt;&lt;P&gt;The strategy is to configure your multivalue input with using prefix, sufix and delimiter, like this:&lt;/P&gt;&lt;P&gt;&amp;lt;fieldset submitButton="false"&amp;gt;&lt;BR /&gt;&amp;lt;input type="multiselect" token="field1"&amp;gt;&lt;BR /&gt;&amp;lt;label&amp;gt;field1&amp;lt;/label&amp;gt;&lt;BR /&gt;&amp;lt;choice value="value1"&amp;gt;value1&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="value2"&amp;gt;value2&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="value3"&amp;gt;value3&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;delimiter&amp;gt;,&amp;lt;/delimiter&amp;gt;&lt;BR /&gt;&amp;lt;prefix&amp;gt;| stats sum(&amp;lt;/prefix&amp;gt;&lt;BR /&gt;&amp;lt;suffix&amp;gt;)&amp;lt;/suffix&amp;gt;&lt;BR /&gt;&amp;lt;/input&amp;gt;&lt;BR /&gt;&amp;lt;/fieldset&amp;gt;&lt;/P&gt;&lt;P&gt;Via UI it will look like this:&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2024-10-17 161730.png" style="width: 504px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/33134i2F0A4337ED94CA2F/image-size/large?v=v2&amp;amp;px=999" role="button" title="Screenshot 2024-10-17 161730.png" alt="Screenshot 2024-10-17 161730.png" /&gt;&lt;span class="lia-inline-image-caption" onclick="event.preventDefault();"&gt;Screenshot 2024-10-17 161730.png&lt;/span&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;So in your search you'll simply do:&lt;/P&gt;&lt;P&gt;|makeresults $field1$&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;where |makeresults is your actual search. The token will append | sum(&amp;lt;selected_values&amp;gt;)&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Then you can add the proper grouping fields and etc to make that happen as you want it to. (like add the "&lt;SPAN&gt;as Total by Jobname" after the ")" suffix&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Thu, 17 Oct 2024 19:19:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Sum-columns-selected-from-a-dropdown-menu/m-p/702215#M57596</guid>
      <dc:creator>victor_menezes</dc:creator>
      <dc:date>2024-10-17T19:19:22Z</dc:date>
    </item>
    <item>
      <title>Re: Sum columns selected from a dropdown menu</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Sum-columns-selected-from-a-dropdown-menu/m-p/702221#M57598</link>
      <description>&lt;P&gt;Thank you so much Victor!!&lt;/P&gt;</description>
      <pubDate>Thu, 17 Oct 2024 19:50:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Sum-columns-selected-from-a-dropdown-menu/m-p/702221#M57598</guid>
      <dc:creator>ravikumar_sri20</dc:creator>
      <dc:date>2024-10-17T19:50:50Z</dc:date>
    </item>
  </channel>
</rss>

