topic Re: help to use a multivalue field in a dropdown list in Splunk Search

How to use a multivalue field in a dropdown list?

jip31 — Wed, 05 Oct 2022 13:40:03 GMT

Hello

as you can see "type" field as 3 values : stand, vd or xe

if the "type" field is "vd" or "xe", I need to gather them in a field called "virt" but i dont succeed

could you help me please?

<input type="dropdown" token="type" searchWhenChanged="true"> <label>Environnement source</label> <choice value="*">*</choice> <choice value="stand">stand</choice> <choice value="type=(vd OR xe)">virt</choice> <default>*</default> <initialValue>*</initialValue> </input>

Re: help to use a multivalue field in a dropdown list

kamlesh_vaghela — Wed, 05 Oct 2022 11:04:32 GMT

@jip31

Are you looking for something like this?

<input type="dropdown" token="type" searchWhenChanged="true"> <label>Environnement source</label> <choice value="*">*</choice> <choice value="stand">stand</choice> <choice value="vd" OR type="xe">virt</choice> <default>*</default> <initialValue>*</initialValue> <prefix>type="</prefix> <suffix>"</suffix> </input>

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: help to use a multivalue field in a dropdown list

jip31 — Wed, 05 Oct 2022 11:31:38 GMT

it doesnt works

if i just put

<input type="dropdown" token="type" searchWhenChanged="true"> <label>Environnement source</label> <choice value="*">*</choice> <choice value="standalone">stand</choice> </input>

it works

but with this it doent works

<input type="dropdown" token="type" searchWhenChanged="true"> <label>Environnement source</label> <choice value="*">*</choice> <choice value="stand">standalone</choice> <choice value="vd" OR type="xe">virt</choice> <default>*</default> <initialValue>*</initialValue> <prefix>type="</prefix> <suffix>"</suffix> </input>

Re: help to use a multivalue field in a dropdown list

kamlesh_vaghela — Wed, 05 Oct 2022 11:25:36 GMT

@jip31

Did you try this?

MY_SEARCH $type$ | OTHER SEARCH

My Sample Code:

<row> <panel> <table> <search> <query>| makeresults | eval type="stand,vd,xe",type=split(type,",") |stats count by type | search $type$</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row>

Can you please share your sample search code only?

Re: help to use a multivalue field in a dropdown list

jip31 — Wed, 05 Oct 2022 11:47:08 GMT

here is

<form> <input type="dropdown" token="type" searchWhenChanged="true"> <label>Environnement source</label> <choice value="*">*</choice> <choice value="stand">stand</choice> <choice value="vd" OR type="xe">virt</choice> <default>*</default> <initialValue>*</initialValue> <prefix>type="</prefix> <suffix>"</suffix> </input> <row> <panel> <single> <title>ww</title> <search> <query>index=test type="$type$"</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search>

Re: help to use a multivalue field in a dropdown list

kamlesh_vaghela — Wed, 05 Oct 2022 11:55:43 GMT

@jip31

Change your search with this.

<search> <query>index=test $type$ </query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search>

Re: help to use a multivalue field in a dropdown list

jip31 — Wed, 05 Oct 2022 12:07:44 GMT

perfect thanks