topic Re: How to filter the values of 5 columns using checkbox? in Splunk Search

How to filter the values of 5 columns using checkbox?

Hanliamadeus — Tue, 30 Apr 2019 13:32:13 GMT

Let's imagine that I have a table as the picture below displayed.
Column 5 listed the column names who have the "YES" value.

Now, I need to create a Checkbox, where lists the column names of "column1" to "column 4", if I click "Column2" option in the checkbox, the table would only display where Column5 has "Column2" value. If I click "Column1" and "Column3", the table will only show where column5 has "Column1/ Column3".

I know how to list all the values of Column 5 in the checkbox, but I just need to show the single value instead of the combined values.
Please tell me how to do that, I hope my explanation is clear, if you are confused, please let me know, thank you very much.

Re: How to filter the values of 5 columns using checkbox?

Sukisen1981 — Tue, 30 Apr 2019 20:12:52 GMT

what happens if i just choose column1 ? is it supposed to return rows 1 and 3 as the result? Also, why do you want a check box and not a multiselect input token?

Re: How to filter the values of 5 columns using checkbox?

niketn — Wed, 01 May 2019 15:10:03 GMT

@Hanliamadeus please try the following run anywhere example based on the sample data provided which sets the token $tokColumnFilter$ set through the checkbox:

<form>
  <label>Checkbox Filter</label>
  <fieldset submitButton="false">
    <input type="checkbox" token="tokColumnFilter" searchWhenChanged="true">
      <label>Filter based on Columns</label>
      <choice value="*">All</choice>
      <choice value="Column1">Column1</choice>
      <choice value="Column2">Column2</choice>
      <choice value="Column3">Column3</choice>
      <choice value="Column4">Column4</choice>
      <prefix>Column5="</prefix>
      <suffix>"</suffix>
      <delimiter>/</delimiter>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| fields - _time
| eval data="YES,NO,YES,NO,Column1/Column3;NO,YES,NO,NO,Column2;YES,NO,YES,YES,Column1/Column3/Column4"
| makemv data delim=";"
| mvexpand data
| makemv data delim=","
| eval Column1=mvindex(data,0),
       Column2=mvindex(data,1),
       Column3=mvindex(data,2),
       Column4=mvindex(data,3),
       Column5=mvindex(data,4)
| fields Column*
| search $tokColumnFilter$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Re: How to filter the values of 5 columns using checkbox?

Hanliamadeus — Thu, 02 May 2019 13:52:44 GMT

Thank you very much for your help! It's a good solution.