Could create search message in multiselect filter

[gemrose]

I am getting error "could not create search". How to fix this error ?

xml::

<input type="multiselect" token="environment">
<label>Environments</label>
<choice value="cfp08">p08</choice>
<choice value="cfp07">p07</choice>
<choice value="*">ALL</choice>
<default>*</default>
<valuePrefix>environment =</valuePrefix>
<delimiter> OR </delimiter>
<search>
<query/>
</search>
<fieldForLabel>environment</fieldForLabel>
<fieldForValue>environment</fieldForValue>
</input>

[isoutamo]

Hi

you haven't add any SPL for query there.

You could check and use Splunk Dashboard example app https://splunkbase.splunk.com/app/1603 for creating your own dashboards.

            <input type="multiselect" token="sourcetype_token" searchWhenChanged="true">
                <default>splunkd, splunk_web_service, splunkd_access</default>
                <!-- The final value will be surrounded by prefix and suffix -->
                <prefix>(</prefix>
                <suffix>)</suffix>
                <!-- Each value will be surrounded by the valuePrefix and valueSuffix -->
                <valuePrefix>sourcetype="</valuePrefix>
                <valueSuffix>"</valueSuffix>
                <!-- All the values and their valuePrefix and valueSuffix will be concatenated together with the delimiter between them -->
                <delimiter> OR </delimiter>
                <choice value="*">ALL</choice>
                <fieldForLabel>sourcetype</fieldForLabel>
                <fieldForValue>sourcetype</fieldForValue>
                <search>
                    <query>index=_internal | stats count by sourcetype</query>
                    <earliest>0</earliest>
                </search>
            </input>

Just add/modify <search><query>....</query></search> part into your form.

r. Ismo