Dear support,
I tried to build a multi-select control and use it in a search, but I have "Search is waiting for input... ",
in every case of the input being to default *, single value or multi value.
I followed exactly (tried) the example given in the Doc "Multiselect input example";
link text
My code is below:
<input type="multiselect" token="field_nt_event_id" searchWhenChanged="false">
<label>Select one or more field_nt_event_id</label>
<choice value="*">All</choice>
<choice value="4">name04</choice>
<choice value="8">name08</choice>
<choice value="12">name12</choice>
<!-- Build multiselect search:
(sourcetype ="value1" OR sourcetype ="value2" OR ...)
-->
<prefix>(</prefix>
<valuePrefix>NT_EVENT_ID ="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
</input>
<table>
<search>
<query>`mc_gen`
| search DB_NAME=$field_db_name$ NT_EVENT_ID=$field_nt_event_id$
| table _time DB_HOST NT_RECORD_NO DB_NAME NT_EVENT_ID NT_TYPE NT_MESSAGE
</query>
<earliest>$field_time.earliest$</earliest>
<latest>$field_time.latest$</latest>
</search>
<option name="count">16</option>
<option name="rowNumbers">true</option>
<option name="wrap">false</option>
</table>
The records are there (4,8,12 and more).
Can someone help ?
thanks and regards
Altin
Just remove NT_EVENT_ID=
from your code.
below code will work
<input type="multiselect" token="field_nt_event_id" searchWhenChanged="false">
<label>Select one or more field_nt_event_id</label>
<choice value="*">All</choice>
<choice value="4">name04</choice>
<choice value="8">name08</choice>
<choice value="12">name12</choice>
<!-- Build multiselect search:
(sourcetype ="value1" OR sourcetype ="value2" OR ...)
-->
<prefix>(</prefix>
<valuePrefix>NT_EVENT_ID ="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
</input>
<table>
<search>
<query>`mc_gen`
| search DB_NAME=$field_db_name$ $field_nt_event_id$
| table _time DB_HOST NT_RECORD_NO DB_NAME NT_EVENT_ID NT_TYPE NT_MESSAGE
</query>
<earliest>$field_time.earliest$</earliest>
<latest>$field_time.latest$</latest>
</search>
<option name="count">16</option>
<option name="rowNumbers">true</option>
<option name="wrap">false</option>
</table>
@altink, in order to debug add title to table so that you can display your token values
<table>
<title>$field_db_name$ - $field_nt_event_id$</title>
Please see which token value is not being set.
Thank you very much @nikita_p and @niketn
I added the debug table title and get the following result (tested with a Database set to *)
Multiselect Output
Empty "" - $field_nt_event_id$
All "" - (NT_EVENT_ID ="")
44444 "" - (NT_EVENT_ID ="4")
88888 "" - (NT_EVENT_ID ="8")
44444 and 88888 "" - (NT_EVENT_ID ="4" OR NT_EVENT_ID ="8")
best regards
Altin
Just remove NT_EVENT_ID=
from your code.
below code will work
<input type="multiselect" token="field_nt_event_id" searchWhenChanged="false">
<label>Select one or more field_nt_event_id</label>
<choice value="*">All</choice>
<choice value="4">name04</choice>
<choice value="8">name08</choice>
<choice value="12">name12</choice>
<!-- Build multiselect search:
(sourcetype ="value1" OR sourcetype ="value2" OR ...)
-->
<prefix>(</prefix>
<valuePrefix>NT_EVENT_ID ="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
</input>
<table>
<search>
<query>`mc_gen`
| search DB_NAME=$field_db_name$ $field_nt_event_id$
| table _time DB_HOST NT_RECORD_NO DB_NAME NT_EVENT_ID NT_TYPE NT_MESSAGE
</query>
<earliest>$field_time.earliest$</earliest>
<latest>$field_time.latest$</latest>
</search>
<option name="count">16</option>
<option name="rowNumbers">true</option>
<option name="wrap">false</option>
</table>
thank you very much @493669
but code pasted looks the same
did you mean replace
<valuePrefix>NT_EVENT_ID ="</valuePrefix>
with
<valuePrefix>"</valuePrefix>
?
best regards
Altin
Hi @altink
your token $field_nt_event_id$
already has NT_EVENT_ID=""
so just replace NT_EVENT_ID=$field_nt_event_id$
by $field_nt_event_id$
thank you very much
I did that and I do get "Search is waiting for input...." in every multi-select combination
Your answer is correct @493669
remove of the NT_EVENT_ID= made it.
I think my initial "Search is waiting for input...." happened because I hadn't refreshed the form.
The DB_NAME is OK whenever as a value or as *
Thank you very much,
best regards
Altin
it means $field_db_name$
is also not set properly so if you could share xml for that input also
and not sure where you have set $field_db_name$
If you could share xml for that input also
Hi @altink,
Could you check splunk answer in below link. It might help you.
https://answers.splunk.com/answers/529581/how-use-multiselect-to-pass-multiple-selected-valu.html
Also check below splunk docs for token usage.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/tokens
Your search references $field_db_name$
, which doesn't appear to be set in any inputs. Is this a typo, or is it intended to be set by an input that isn't actually present?
It is an existing input that is not displayed. It is set to * default at the input element (dropdown).