Dashboards & Visualizations

How do I connect multiselect to another multiselect?

jtabilas
Loves-to-Learn Everything

Hi guys, i want connect my multiselect City to multiselect Category. First i try with add token in the second multiselect (Category) but don't work :(. Any solutions? screen.png

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jtabilas,

could you share your code as text (using the Inser/Edit Code Sample button)?

Anyway, in the search of the second multiselect, you have to insert the token of the first one.

Ciao.

Giuseppe

0 Karma

jtabilas
Loves-to-Learn Everything

so this is my solution

      <input type="multiselect" token="city" searchWhenChanged="true">
        <label>City</label>
        <delimiter>,</delimiter>
        <choice value="*">All</choice>
        <fieldForLabel>city</fieldForLabel>
        <fieldForValue>city</fieldForValue>
        <search>
          <query>source="*pubblico.json" index="google_reports" sourcetype="ga_json"  | fields city  | dedup city </query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <default>*</default>
        <valuePrefix>"</valuePrefix>
        <valueSuffix>"</valueSuffix>
      </input>
      <input type="multiselect" token="category2" searchWhenChanged="true">
        <label>Category</label>
        <default>*</default>
        <choice value="*">All</choice>
        <delimiter> ,</delimiter>
        <fieldForLabel>category</fieldForLabel>
        <fieldForValue>category</fieldForValue>
        <search>
          <query>| inputlookup categories| search $city$ | fields category |  dedup category</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <valuePrefix>"</valuePrefix>
        <valueSuffix>"</valueSuffix>
      </input>
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jtabilas,

when you create an input, you have two choices in field definition: you can put the field definition in the search or in the input itself.

You didn't defined the field both in the first input and in the second input search,

so, please, checking that the field to use is exactly called "city" also in the lookup, try the following search n the second input:

| inputlookup categories
| search city="$city$" 
| fields category 
| dedup category

Then, in general, assign a name to all tokens, also to the Time (you have "field1" for the time).

Ciao.

Giuseppe

0 Karma

jtabilas
Loves-to-Learn Everything

Hi, thank you. But what do you mean "You didn't defined the field both"?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jtabilas,

you need to configure the condition "city=$city$".

You can do this in the first input or in the second, but you didn't configured it in the first input

<prefix>city="</prefix>
<suffix>"</suffix>

and neither in the second input search:

city="$city$"

using only

search $city$

as in your search, you don't correctly address you search terms.

So, if you want to maintain the condition you used in the second input search, you have to add prefix and suffix to your first input.

In other words:

<input type="multiselect" token="city" searchWhenChanged="true">
        <label>City</label>
        <delimiter>,</delimiter>
        <choice value="*">All</choice>
        <fieldForLabel>city</fieldForLabel>
        <fieldForValue>city</fieldForValue>
        <search>
          <query>
             index="google_reports" sourcetype="ga_json" source="*pubblico.json" 
            | fields city 
            | dedup city 
          </query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <default>*</default>
        <prefix>city="</prefix>
        <suffix>"</suffix>
      </input>
      <input type="multiselect" token="category2" searchWhenChanged="true">
        <label>Category</label>
        <default>*</default>
        <choice value="*">All</choice>
        <delimiter> ,</delimiter>
        <fieldForLabel>category</fieldForLabel>
        <fieldForValue>category</fieldForValue>
        <search>
          <query>
             | inputlookup categories WHERE $city$ 
             | fields category 
             |  dedup category
          </query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <valuePrefix>"</valuePrefix>
        <valueSuffix>"</valueSuffix>
      </input>

Ciao.

Giuseppe

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...