topic Dashboard - multi-select input - how to add "ANY" option apart of the result of a query in Splunk Search

Dashboard - multi-select input - how to add "ANY" option apart of the result of a query

jacortijo — Mon, 12 Oct 2020 15:56:39 GMT

Hi,

I am building a dashboard where I have an multi-select input called locations, which is populated with a query via the dynamic options.

Also, I include a static option called "ANY" with a value *

I have also a token prefix and suffix of double quotes (") and the delimiter of a coma ( , )

My purpose is later is in my query of one panel to use that token in a where IN clause

where location in ($locations$)

when I dont select the ANY value, the query works as expected.

where location in ("XXX", "YYY", "ZZZ")

but when I include the ANY in the multi-select input, the query does not seem to work.

where location in ("XXX", "YYY", "ZZZ","*")

Is it possible to do what I intend? is there any easier way to achieve the same?

Many thanks in advance

Re: Dashboard - multi-select input - how to add "ANY" option apart of the result of a query

ITWhisperer — Mon, 12 Oct 2020 18:13:51 GMT

<input type="multiselect" token="location"> <label>Select one or more location</label> <choice value="All">All</choice> <search> <query>index=abc | dedup location | fields location</query> </search> <fieldForLabel>location</fieldForLabel> <fieldForValue>location</fieldForValue> <prefix>(</prefix> <valuePrefix>location ="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <suffix>)</suffix> <default>All</default> <change> <eval token="form.location">case(mvcount('form.location')=0,"All",mvcount('form.location')>1 AND mvfind('form.location',"All")>0,"All",mvcount('form.location')>1 AND mvfind('form.location',"All")=0,mvfilter('form.location'!="All"),1==1,'form.location')</eval> <eval token="location_choice">if(mvfind('form.location',"All")=0,"location=*",$location$)</eval> </change> </input>

Your query would use $location_choice$ to filter your results

Re: Dashboard - multi-select input - how to add "ANY" option apart of the result of a query

jacortijo — Tue, 13 Oct 2020 09:53:44 GMT

Thanks for the suggestion but I get an "undefined" error in Splunk while using your proposal.

I think that the error comes from the third option in the case clause.

case(mvcount('form.location')==0,"ALL", // Reasoning: If there is nothing selected... location = "ALL"

mvcount('form.location')>1 AND mvfind('form.location',"ALL")>0,"ALL", // Reasoning: if there are multiple selections including ALL.... location ="ALL"

Unfortunately I dont understand the meaning of the last case.

mvcount('form.location')>1 AND mvfind('form.location',"ALL")==0, mvfilter('form.location'!="ALL"),1==1,'form.location')

I assume that the purpose is: "if there are many selections and none is ALL, just leave it untouched. "

As it didnt work, I tried to replace it with some other code

mvcount('form.location')>1 AND mvfind('form.location',"ALL")==0,'form.location')

but it didnt work at all. Actually ALL get locked in the input field, it is not possible to select anything else or even to remove the ALL

Re: Dashboard - multi-select input - how to add "ANY" option apart of the result of a query

ITWhisperer — Tue, 13 Oct 2020 10:12:20 GMT

mvcount('form.location')=0,"All" - if nothing is selected, set to All

mvcount('form.location')>1 AND mvfind('form.location',"All")>0,"All" - if All has just been added, set to All

mvcount('form.location')>1 AND mvfind('form.location',"All")=0,mvfilter('form.location'!="All") - if something has been added after All, remove All

1==1,'form.location' - otherwise , leave as is

Note that the case has to be all on one line otherwise you get an error

Re: Dashboard - multi-select input - how to add "ANY" option apart of the result of a query

jacortijo — Tue, 13 Oct 2020 11:33:58 GMT

I tried once again and it does not work. every time I click in any value of the drop down box, the element seems to be added and removed from the input.

<input type="multiselect" token="location"> <label>Select location</label> <fieldForLabel>location</fieldForLabel> <fieldForValue>location</fieldForValue> <search> <query>index=xxx | dedup location | table location | sort + location</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <valuePrefix>location="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <choice value="All">All</choice> <prefix>(</prefix> <suffix>)</suffix> <change> <eval token="form.location">case(mvcount('form.location')=0,"All",mvcount('form.location')>1 AND mvfind('form.location',"All")>0,"All",mvcount('form.location')>1 AND mvfind('form.location',"All")=0,mvfilter('form.location'!="All"),1==1,'form.location')</eval> <eval token="location_choice">if(mvfind('form.location',"All")=0,"location=*",$location$)</eval> </change> </input>

Re: Dashboard - multi-select input - how to add "ANY" option apart of the result of a query

ITWhisperer — Tue, 13 Oct 2020 11:46:44 GMT

Try moving the

<choice value="All">All</choice>

so it is above the search

      <search>
        <query>index=xxx | dedup location | table location | sort + location</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>

That way, if it is there, it will be at index 0 which the case statement relies on

Re: Dashboard - multi-select input - how to add "ANY" option apart of the result of a query

jacortijo — Tue, 13 Oct 2020 12:15:59 GMT

The issue remains. I tried to simplify it with no luck either.

<change> <eval token="location_choice">if(mvfind('form.location',"All")>=0,"location=*",$location$)</eval> </change>

Reasoning: if All is part of the selection , location_choice is set to "location=*" otherwise $location$.

Unfortunately I get a really weird behaviour. It seems like the value of location_choice remains even after I removed the items in the input field. So the dashboard searches are using the old location_choice , very inconsistent behaviour.

could you confirm how does the input actually work? I select a value, the value get appended to the field and fires the change event . Then the eval tag just replace the field value with the result of the case clauses, right? In which moment all prefixes and suffixes are appended? only when the $location$ gets extracted in the second eval?

Re: Dashboard - multi-select input - how to add "ANY" option apart of the result of a query

jacortijo — Tue, 13 Oct 2020 12:45:59 GMT

I finally solved it, far from perfect but it seems to work.

I basically remove all the change events and put a * as value for All.

It generated a not optimal query but it works at least.

<input type="multiselect" token="location" searchWhenChanged="true"> <label>Select location</label> <fieldForLabel>location</fieldForLabel> <fieldForValue>location</fieldForValue> <choice value="*">All</choice> <search> <query>index=xxx | dedup location | table location | sort + location</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <valuePrefix>location="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <prefix>(</prefix> <suffix>)</suffix> </input>

Thanks for the support anyway!

Re: Dashboard - multi-select input - how to add "ANY" option apart of the result of a query

ITWhisperer — Tue, 13 Oct 2020 13:05:44 GMT

The first eval with the case statement operates on the multivalue field associated with the multiselect dropdown and basically deals with whether All is selected or needs to be removed.

The second eval uses the token value built up by using the prefix, value prefix, value, value suffix, and suffix, and assigns the choice token to this string unless All is selected in which case it uses the * option.

The prefixes and suffixes etc. are always there, but just in the named token, not in the multi-value field associated with the multi-select dropdown.

topic Dashboard - multi-select input - how to add &quot;ANY&quot; option apart of the result of a query in Splunk Search

Dashboard - multi-select input - how to add "ANY" option apart of the result of a query

Re: Dashboard - multi-select input - how to add "ANY" option apart of the result of a query

Re: Dashboard - multi-select input - how to add "ANY" option apart of the result of a query

Re: Dashboard - multi-select input - how to add "ANY" option apart of the result of a query

Re: Dashboard - multi-select input - how to add "ANY" option apart of the result of a query

Re: Dashboard - multi-select input - how to add "ANY" option apart of the result of a query

Re: Dashboard - multi-select input - how to add "ANY" option apart of the result of a query

Re: Dashboard - multi-select input - how to add "ANY" option apart of the result of a query

Re: Dashboard - multi-select input - how to add "ANY" option apart of the result of a query

topic Dashboard - multi-select input - how to add "ANY" option apart of the result of a query in Splunk Search