inputlookup with pulldown - search not working

[Moogz]

Hey all,

I have a pulldown from sideview that allows me to have multiple selections and draws them on a chart. Both the pulldown and chart are generated from the same inputlookup csv file. The pulldown works fine, and the search works fine outside of the form.. but does not return any results when used in the form.. the csv file has 3 fileds, _time,ChargeType,Total_Cost

This is the pulldown..

  module name="Pulldown">
    param name="name">selectedChargeTypes</param>
    param name="label">ChargeType</param>
    param name="size">10</param>
    param name="template">ChargeType="$value$"</param>
    param name="separator">+OR+</param>
    param name="outerTemplate">( $value$ )</param>
    param name="staticFieldsToDisplay"></param>
    param name="searchFieldsToDisplay">
      list>
        param name="label">ChargeType</param>
        param name="value">ChargeType</param>
      /list>

Here is the search that doesn't work when in form only..

    module name="Search">
      param name="search">| inputlookup lkp_cost_by_chargetype.csv | search ChargeType="$selectedChargeTypes$" | timechart values(Total_Cost) by ChargeType</param>
 ...

Thanks for any help!

[Moogz]

Thank you much.. simple solution that I was overlooking!

[sideview · Accepted solution]

You just have one too many ingredients going on, namely you're putting your own ChargeType="" into the Search when the multiselect modules params are taking care of all that.

The multiselect pulldown outputs a key of $selectedChargeTypes$, and when the Pulldown has two elements selected, that ey will have a value like

( ChargeType="firstValue" OR ChargeType="fifthValue" ) 

Which means that your search should look like:

<module name="Search">
  <param name="search">| inputlookup lkp_cost_by_chargetype.csv | search * $selectedChargeTypes$ | timechart values(Total_Cost) by ChargeType</param>

with that extra ChargeType="" you've got in there wrapping around the Pulldown's token, the final search string ends up very different from what you want. It may even be generating a parse error from splunk when you try and submit it.

Anyway, remove that ChargeType= and the quotes and you'll be good to go.

---

One great tip, is that whenever a piece of your form UI isn't working out as expected, throw an HTML module in there and have a look at how the pieces fit together. Like so:

<module name="HTML">
  <param name="html"><![CDATA[
   DEBUGGING<br>
   selectedChargeTypes is <b>$selectedChargeTypes$</b><br>
   the search at this point is <b>$search$</b>
  ]]></param>
</module>

it's a tiny trick but extremely useful. In fact I often leave these modules in the views permanently but just commented out. And then there's also the Runtime Debugging mode in the Sideview Editor, which is a nuclear option of the same sort of thing.

Also, I've been finding that lots of people don't know there's a newer 2.1 version available from the Sideview site, so check that out if you're still on the old 1.3.X version from Splunkbase. http://sideviewapps.com/apps/sideview-utils