topic multiselect with AND in Dashboards & Visualizations

multiselect with AND

sarit_s6 — Wed, 25 Jun 2025 09:14:37 GMT

Hello

is it possible to use multiselect input in classic dashboard so the selected objects there will be
key=value AND key=value1 ? if im using IN its acts like OR

Thanks

Re: multiselect with AND

VatsalJagani — Wed, 25 Jun 2025 09:27:05 GMT

Yes you can do that. @sarit_s6

You can make use of

<delimiter>	text	A string that will be placed between each selected value. Typically, you specify " OR " or " AND " using upper case – do not specify the quote marks, but specify a space character before and after the text.
<valuePrefix>	text	String prefixed to the value of the input element. Can be a regular expression.
<valueSuffix>	text	String appended to the value of the input element. Can be a regular expression.

delimiter -> AND

valuePrefix -> key="

valueSuffix -> "

This will prepare something like -> key="A" AND key="B" ....

I hope this helps!!!!

Re: multiselect with AND

gcusello — Wed, 25 Jun 2025 09:33:44 GMT

Hi @sarit_s6 ,

yes, you can use the IN operator and comma as separator.

Ciao.

Giuseppe

Re: multiselect with AND

sarit_s6 — Wed, 25 Jun 2025 09:40:25 GMT

thanks

its working

is it also possible to set it like that so when object is selected it will remove the "ALL" automatically ?

Re: multiselect with AND

VatsalJagani — Wed, 25 Jun 2025 09:57:27 GMT

@sarit_s6 - That one requires Javascript to be written to remove "All" option.

Reference - https://community.splunk.com/t5/Dashboards-Visualizations/Remove-quot-All-quot-from-Multiselect-Input-in-Dashboard/m-p/301375

OR you can opt for complex XML editing suggested in this reference - https://community.splunk.com/t5/Dashboards-Visualizations/Remove-ALL-from-multi-select-input-once-any-value-is-selected/m-p/711199

I hope this helps!!! Kindly upvote if it does!!!

Re: multiselect with AND

sarit_s6 — Wed, 25 Jun 2025 10:03:26 GMT

well, im using splunk cloud so JS is not an option and i've tries the second option but its not working
maybe something in the copy paste became wrong ?

<input type="multiselect" token="categories"> <label>Categories</label> <choice value="*">ALL</choice> <fieldForLabel>testCategories</fieldForLabel> <fieldForValue>testCategories</fieldForValue> <search> <query>index="stg_observability_s" sourcetype=SplunkQuality earliest=$time.earliest$ latest=$time.latest$ | search AdditionalData.domain="$domain$" AdditionalData.pipelineName="$pipelineName$" AdditionalData.buildId="$jobid$" AdditionalData.repoUrl="$repo$" | stats count by testCategories</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <default>*</default> <initialValue>*</initialValue> <delimiter> AND </delimiter> <valuePrefix>testCategories="</valuePrefix> <valueSuffix>"</valueSuffix> <change> <eval token="form.categories">case(mvcount('form.categories')=0,"All",mvcount('form.categories')>1 AND mvfind('form.categories',"All")>0,"All",mvcount('form.categories')>1 AND mvfind('form.categories',"All")=0,mvfilter('form.categories'!="All"),1==1,'form.categories')</eval> <eval token="categories_choice">if('form.categories'=="All","categories=\"*\"",'categories')</eval> </change> </input>

Re: multiselect with AND

ITWhisperer — Wed, 25 Jun 2025 10:56:02 GMT

It is not so much the copy paste, it is the value used for All, this needs to be "All" not "*" (similarly with the initialValue)

<form version="1.1" theme="light"> <label>All handling</label> <search id="base_search"> <query>| makeresults format=csv data="categories A B C" | table categories</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <fieldset submitButton="false"> <input type="multiselect" token="categories"> <label>Categories</label> <choice value="All">All</choice> <default>All</default> <initialValue>All</initialValue> <fieldForLabel>categories</fieldForLabel> <fieldForValue>categories</fieldForValue> <search base="base_search"> <query> |stats count by categories </query> </search> <valuePrefix>testCategories="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> AND </delimiter> <change> <eval token="form.categories">case(mvcount('form.categories')=0,"All",mvcount('form.categories')>1 AND mvfind('form.categories',"All")>0,"All",mvcount('form.categories')>1 AND mvfind('form.categories',"All")=0,mvfilter('form.categories'!="All"),1==1,'form.categories')</eval> <eval token="categories_choice">if('form.categories'=="All","categories=\"*\"",'categories')</eval> </change> </input> </fieldset> <row> <panel> <html> Categories: $categories_choice$ </html> </panel> </row> </form>