topic Re: Why am I unable to pass values across to multivalue fields? in Splunk Search

Why am I unable to pass values across to multivalue fields?

ssadh_splunk — Tue, 29 Sep 2020 18:54:47 GMT

Hi,

I am trying to build a dashboard with 4 MultiValue Input fields.

MV_field1 with Values MVF1_A, MVF1_B,..... MVF1_N (so on)
MV_field2 with Values MVF2_A,MVF2_B,......MVF2_N
MV_field3 with Values MVF3_A,MVF3_B,......MVF3_N
MV_field4 with Values MVF4_A,MVF4_B,......MVF4_N

MV_field2 values depend on MV_field1, MV_field3 depends on MV_field2 and so on..

The data is coming from a lookup and the field values are populating for MV_field1 based on this search

| inputlookup mylookup.csv
| fields "fieldA" 
| dedup fieldA

MV_field2 values are dynamically getting populated by using below search, based on the values I chose from first multivalue input list

| inputlookup mylookup.csv
| search "fieldA" IN ($fieldA$)
| dedup fieldB
| fields "fieldB"

However, when I select multiple values in MV_field2 along with MV_field1, my third MV_field3 list doest get populated. It gets stuck with message, "Could not create Search." and mouse over shows the message, "Search is waiting for input"

The search I am using to populate the third input is as below:

| inputlookup mylookup.csv
| search  ("fieldA" IN ($fieldA$)) AND (fieldB IN $fieldB$)
| fields fieldC
| dedup fieldC

Any pointers would be greatly appreciated.

Re: Why am I unable to pass values across to multivalue fields?

somesoni2 — Mon, 09 Apr 2018 18:36:40 GMT

Check if the field names and token names used in your MV_field3 multiselect input query are correct (they are case sensitive). The message suggests that one of the tokens in that query is not resolving to a valid value.

Re: Why am I unable to pass values across to multivalue fields?

ssadh_splunk — Tue, 10 Apr 2018 06:41:55 GMT

Yes, all spellings are correct and case sensitivity is followed across the dashboard.

Re: Why am I unable to pass values across to multivalue fields?

Sukisen1981 — Sat, 14 Apr 2018 19:20:18 GMT

i think you have been editing the same dashboard and saving your dashboard as you build on the tokens, save refresh 2-3 times, log out and log back in...i know it sounds silly but it might just work

Re: Why am I unable to pass values across to multivalue fields?

DalJeanis — Sun, 15 Apr 2018 01:12:35 GMT

If the syntax of your second search is working, then format the second half of your third search exactly the way that worked ... ("fieldB" IN ($fieldB$)) .

Re: Why am I unable to pass values across to multivalue fields?

niketn — Sun, 15 Apr 2018 08:58:38 GMT

@ssadh would it be possible for you to share the Simple XML code for multi-value fields?