Archive

Error in multiselect - Could not create search

Communicator

Below is the code for multiselect which gets populated dynamically based on user selection. The Search query seems to be working fine outside using Search & Reporting app. But doesnt work when added as dynamic query to dashboard.

<input type="multiselect" token="tokenhost" searchWhenChanged="true">
  <label>$hosttype$</label>
  <search>
    <query>index=app   sourcetype=app_gc_log  | eval host = case(host like "%" +substr(lower($hosttype$),1, 3)+ "%", host)| dedup host | table host</query>
    <earliest>-30d@d</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>host</fieldForLabel>
  <fieldForValue>host</fieldForValue>
  <valuePrefix>host=</valuePrefix>
  <delimiter> OR </delimiter>
</input>
<input type="time" token="field2" searchWhenChanged="true">
  <label></label>
  <default>
    <earliest>-4h@m</earliest>
    <latest>now</latest>
  </default>
</input>
Tags (1)
0 Karma
1 Solution

Explorer

$hosttype$ needs to get an initial value for the search to be built and run.
You can do that in another dynamic input or by giving it a static value in another input.

View solution in original post

0 Karma

Explorer

$hosttype$ needs to get an initial value for the search to be built and run.
You can do that in another dynamic input or by giving it a static value in another input.

View solution in original post

0 Karma

Influencer

What do you mean by "didn't work?" Do you get an error message?

0 Karma

Communicator

Where did you define the $hosttype$ token you are using there?

0 Karma

Communicator

It is passed from another dashboard but I am pretty sure the value is getting passed to $hosttype$. I am able to see the value passed.

0 Karma

Communicator

so you see the new $hosttype$ value in your label? Or is this one empty?

0 Karma

Communicator

i see the value in label

0 Karma

Legend

@sangs8788, Can you try the following search, which converts both terms to be matched into lower case?

index=app sourcetype=app_gc_log 
| eval host = case(match(lower(host),lower(substr("$hosttype$",1, 3))), host) 
| dedup host 
| table host
| sort host

If this does not work, can you run the same search for multiselect inside a table to see whether you are getting results?

<table>
   <search>
     <query>index=app   sourcetype=app_gc_log  | eval host = case(host like "%" +substr(lower($hosttype$),1, 3)+ "%", host)| dedup host | table host</query>
     <earliest>-30d@d</earliest>
     <latest>now</latest>
   </search>
</table>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Communicator

Error displays right below the multiselect "could not create search"

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!