<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Why is multiselect not working? in Reporting</title>
    <link>https://community.splunk.com/t5/Reporting/Why-is-multiselect-not-working/m-p/602352#M11492</link>
    <description>&lt;P&gt;Hi,&lt;/P&gt;
&lt;P&gt;I am using a multiselect input with the following query:&lt;BR /&gt;|inputlookup ABC&lt;BR /&gt;| eval hjk=_key&lt;BR /&gt;| lookup XYZ asset OUTPUT ass AS name, app AS application&lt;BR /&gt;| stats values( application)&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="POR160893_0-1655670799482.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/20164i94C8C3AE09802985/image-size/medium?v=v2&amp;amp;px=400" role="button" title="POR160893_0-1655670799482.png" alt="POR160893_0-1655670799482.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;&lt;BR /&gt;However, when I add this onto the actual dashboard, no results are generated as expected on the actual input.&lt;BR /&gt;&lt;BR /&gt;&lt;BR /&gt;What am I doing incorrectly?&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="POR160893_1-1655670832518.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/20165i76019B89FA0B7182/image-size/medium?v=v2&amp;amp;px=400" role="button" title="POR160893_1-1655670832518.png" alt="POR160893_1-1655670832518.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;&lt;BR /&gt;&lt;BR /&gt;Thanks,&lt;/P&gt;</description>
    <pubDate>Tue, 21 Jun 2022 16:42:41 GMT</pubDate>
    <dc:creator>POR160893</dc:creator>
    <dc:date>2022-06-21T16:42:41Z</dc:date>
    <item>
      <title>Why is multiselect not working?</title>
      <link>https://community.splunk.com/t5/Reporting/Why-is-multiselect-not-working/m-p/602352#M11492</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;
&lt;P&gt;I am using a multiselect input with the following query:&lt;BR /&gt;|inputlookup ABC&lt;BR /&gt;| eval hjk=_key&lt;BR /&gt;| lookup XYZ asset OUTPUT ass AS name, app AS application&lt;BR /&gt;| stats values( application)&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="POR160893_0-1655670799482.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/20164i94C8C3AE09802985/image-size/medium?v=v2&amp;amp;px=400" role="button" title="POR160893_0-1655670799482.png" alt="POR160893_0-1655670799482.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;&lt;BR /&gt;However, when I add this onto the actual dashboard, no results are generated as expected on the actual input.&lt;BR /&gt;&lt;BR /&gt;&lt;BR /&gt;What am I doing incorrectly?&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="POR160893_1-1655670832518.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/20165i76019B89FA0B7182/image-size/medium?v=v2&amp;amp;px=400" role="button" title="POR160893_1-1655670832518.png" alt="POR160893_1-1655670832518.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;&lt;BR /&gt;&lt;BR /&gt;Thanks,&lt;/P&gt;</description>
      <pubDate>Tue, 21 Jun 2022 16:42:41 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Why-is-multiselect-not-working/m-p/602352#M11492</guid>
      <dc:creator>POR160893</dc:creator>
      <dc:date>2022-06-21T16:42:41Z</dc:date>
    </item>
    <item>
      <title>Re: Muliselect is not working</title>
      <link>https://community.splunk.com/t5/Reporting/Why-is-multiselect-not-working/m-p/602359#M11493</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/240743"&gt;@POR160893&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;It looks &amp;nbsp;your search out is multivalued field and the column you have used in fieldLabel and fieldValue looks different. can you please verify the search output and the fields you have used in the MultiSelect configurations?&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thanks&lt;BR /&gt;KV&lt;BR /&gt;&lt;BR /&gt;&lt;BR /&gt;If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.&lt;/P&gt;</description>
      <pubDate>Mon, 20 Jun 2022 04:51:30 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Why-is-multiselect-not-working/m-p/602359#M11493</guid>
      <dc:creator>kamlesh_vaghela</dc:creator>
      <dc:date>2022-06-20T04:51:30Z</dc:date>
    </item>
    <item>
      <title>Re: Muliselect is not working</title>
      <link>https://community.splunk.com/t5/Reporting/Why-is-multiselect-not-working/m-p/602377#M11494</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/240743"&gt;@POR160893&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;some additional info to debug your issue:&lt;/P&gt;&lt;P&gt;are you sure to have the asset field also in the first lookup?&lt;/P&gt;&lt;P&gt;in the screenshout I see that asset field is also in output and this is different than the search you shared, is it correct?&lt;/P&gt;&lt;P&gt;then, instead the last row, you could use&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;|  stats BY application&lt;/LI-CODE&gt;&lt;P&gt;or&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| dedup application,
| sort application
| table application&lt;/LI-CODE&gt;&lt;P&gt;then, why do you used "&lt;SPAN&gt;| eval hjk=_key" ?&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Ciao.&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Giuseppe&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 20 Jun 2022 07:37:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Why-is-multiselect-not-working/m-p/602377#M11494</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2022-06-20T07:37:15Z</dc:date>
    </item>
  </channel>
</rss>

