All Apps and Add-ons

Populate multiselect input choices with dbxquery results

harveyelowndes
New Member

Hi there,

I have searched far and wide for a solution this problem but no luck so I was hoping someone out there could help me. I have a list of task names stores inside an oracle database. I need the user to be able to search for the names in the multiselect box, show them in the dropdown and select them as part of the multi select. Each name value selected must be comma delimited. I have posted my current code which does not work and I am hoping someone out there is able to help me.

Thanks alot.

    <input type="multiselect" token="taskname">
      <label>Specify task names that you are interested in</label>
      <choice value="^">All</choice>
      <default>^</default>
      <delimiter>,</delimiter>
      <fieldForLabel>taskname</fieldForLabel>
      <fieldForValue>taskname</fieldForValue>
      <search>
        <query>| dbxquery connection=PROD_DB query="SELECT TASK_NAME FROM TASK_RUN WHERE TASK_NAME LIKE '$taskname$%Supertask%' OR TASK_NAME LIKE '%Supertask%$taskname$'"</query>
      </search>
    </input>
0 Karma

twhite_splunk
Splunk Employee
Splunk Employee

Hey there!

I recently was working on something similar, and the I think the below improvements might be what you're looking for. The basic idea, is to go ahead and populate the multiselect options with the generic "Supertask" filter. And then let your users type in the tasknames they want. The multiselect will filter down to just those "Supertask" options that have the taskname your users are typing. They can select the one they want, and then add more.

Also note what @niketnilay mentions - your field name needs to match casing and underscores. Ultimately what you'll have at the end, is a token you can access with $taskname$ that will be comma-delimited, and have any tasks your users included in their multiselect.

 <input type="multiselect" token="taskname">
        <label>Specify task names that you are interested in</label>
        <choice value="^">All</choice>
        <default>^</default>
        <delimiter>,</delimiter>
        <fieldForLabel>TASK_NAME</fieldForLabel>
        <fieldForValue>TASK_NAME</fieldForValue>
        <search>
          <query>| dbxquery connection=PROD_DB query="SELECT TASK_NAME FROM TASK_RUN WHERE TASK_NAME LIKE '%Supertask%'"</query>
        </search>
      </input>

Edit: correct username reference

0 Karma

niketn
Legend

@harveyelowndes, can you please elaborate on what does not work? The dbxquery itself or the delimiter? Have you tested your dbxquery in Splunk search whether it is working fine? Also can you give an example of data being populated in your Multiselect box vs Output string that you need when required values are selected?

In the Dashboard code you need to escape double quotes as &quot;. Also you need to ensure the field name returned from your dbxquery is taskname (with same casing).

On a different note can you tell the purpose of default value All ^?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

cmerriman
Super Champion

why do they HAVE to be comma delimited? can they be pipe delimited instead? i am a little confused by the input because your token is called taskname but you're using the token itself in the query populating it.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...