topic Error in multiselect - Could not create search in Splunk Search

Error in multiselect - Could not create search

sangs8788 — Thu, 23 Nov 2017 09:37:52 GMT

Below is the code for multiselect which gets populated dynamically based on user selection. The Search query seems to be working fine outside using Search & Reporting app. But doesnt work when added as dynamic query to dashboard.

<input type="multiselect" token="tokenhost" searchWhenChanged="true">
  <label>$hosttype$</label>
  <search>
    <query>index=app   sourcetype=app_gc_log  | eval host = case(host like "%" +substr(lower($hosttype$),1, 3)+ "%", host)| dedup host | table host</query>
    <earliest>-30d@d</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>host</fieldForLabel>
  <fieldForValue>host</fieldForValue>
  <valuePrefix>host=</valuePrefix>
  <delimiter> OR </delimiter>
</input>
<input type="time" token="field2" searchWhenChanged="true">
  <label></label>
  <default>
    <earliest>-4h@m</earliest>
    <latest>now</latest>
  </default>
</input>

Re: Error in multiselect - Could not create search

jplumsdaine22 — Thu, 23 Nov 2017 09:54:48 GMT

What do you mean by "didn't work?" Do you get an error message?

Re: Error in multiselect - Could not create search

sangs8788 — Thu, 23 Nov 2017 09:57:04 GMT

Error displays right below the multiselect "could not create search"

Re: Error in multiselect - Could not create search

lukas_loder — Thu, 23 Nov 2017 10:43:04 GMT

Where did you define the $hosttype$ token you are using there?

Re: Error in multiselect - Could not create search

sangs8788 — Thu, 23 Nov 2017 10:50:09 GMT

It is passed from another dashboard but I am pretty sure the value is getting passed to $hosttype$. I am able to see the value passed.

Re: Error in multiselect - Could not create search

lukas_loder — Thu, 23 Nov 2017 11:02:30 GMT

so you see the new $hosttype$ value in your label? Or is this one empty?

Re: Error in multiselect - Could not create search

sangs8788 — Thu, 23 Nov 2017 11:04:18 GMT

i see the value in label

Re: Error in multiselect - Could not create search

niketn — Thu, 23 Nov 2017 11:55:43 GMT

@sangs8788, Can you try the following search, which converts both terms to be matched into lower case?

index=app sourcetype=app_gc_log 
| eval host = case(match(lower(host),lower(substr("$hosttype$",1, 3))), host) 
| dedup host 
| table host
| sort host

If this does not work, can you run the same search for multiselect inside a table to see whether you are getting results?

<table>
   <search>
     <query>index=app   sourcetype=app_gc_log  | eval host = case(host like "%" +substr(lower($hosttype$),1, 3)+ "%", host)| dedup host | table host</query>
     <earliest>-30d@d</earliest>
     <latest>now</latest>
   </search>
</table>

Re: Error in multiselect - Could not create search

danbar6 — Thu, 23 Nov 2017 14:25:06 GMT

$hosttype$ needs to get an initial value for the search to be built and run.
You can do that in another dynamic input or by giving it a static value in another input.