How to create a chart that shows multiple values by default, but have a multiselect drop-down to drill down to a specific value?

jhayIV — Tue, 29 Sep 2020 09:48:56 GMT

I am trying to provide a chart that shows multiple locations as a default, then allow them to use the multiselect to drill down to a specific location. Can someone tell me what I am doing wrong? I am getting No Results Found

The working search looks like this:

table Location,Server_Name,Server_OS_Name|search Location="FORT WORTH RDC" OR "CROSSINGS RDC" |chart count(Server_Name) by Server_OS_Name|

When I set up the drop-down, the search doesn't work:

table Location,Server_Name,Server_OS_Name|search Location="FORT WORTH RDC CROSSINGS RDC" |chart count(Server_Name) by Server_OS_Name|

I tried putting quotes in the Prefix and Suffix

Re: How to create a chart that shows multiple values by default, but have a multiselect drop-down to drill down to a specific value?

sundareshr — Thu, 26 May 2016 20:46:19 GMT

The values returned by the multi-select dropdown is not in the right format for the search. You need to add the right Prefix & SUffix. Try this

Token Prefix=(
Token Suffix=)
Token Value Prefix=Location="
Token Value Suffix=" OR  (there is a space before and after OR)

So when you set the token value, it should look like this (Location="Fort Worth" OR Location="Dallas")

topic Re: How to create a chart that shows multiple values by default, but have a multiselect drop-down to drill down to a specific value? in Splunk Search

How to create a chart that shows multiple values by default, but have a multiselect drop-down to drill down to a specific value?

Re: How to create a chart that shows multiple values by default, but have a multiselect drop-down to drill down to a specific value?