I have a few inputs at the top of my dashboard, one being a multivalue input. Its default is two values, but I often only have one value in there to filter the result show I'd like.
I then click on a field value in a random panel that reloads the dashboard page with the new selected data filtering the entire dashboard. However, this resets the multivalue input back to default. This is not what I want. I've tried this and it places values into the multivalue input instead, but incorrectly so, returning no results:
<link field="filename">
<![CDATA[
/app/Splunk_Files_App/filedata_dashboard?form.filename=$click.value2$&form.index=$index$&form.filetype=$filetype$
]]>
</link>
The problem is the multivalue $filetype$. It literally populates it with "file_type=exe" when I drilldown instead of "EXE".
Here is the multivalue input if needed:
<input type="multiselect" token="filetype" searchWhenChanged="true">
<label>File name</label>
<choice value="*">All</choice>
<default>EXE,PDF</default>
<search>
<query>index=$index$ sourcetype=file_data | dedup file_type | table file_type</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<fieldForLabel>file_type</fieldForLabel>
<fieldForValue>file_type</fieldForValue>
<!-- Build multi-selection search:
EX: (sourcetype ="value1" OR sourcetype ="value2" OR ...)
-->
<prefix>(</prefix>
<valuePrefix>file_type="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
</input>
tldr: I try to populate a multivalue input with itself during a drilldown and it doesn't work as expected. How do I do this?
Try something like this (run anywhere example). See how the multiselect values are formatted (just with delimiter) and how they are used in the search (using subsearch to generate field=value1 OR field=value2... format)
<form>
<label>Multiselect Dropdown</label>
<fieldset submitButton="false">
<input type="multiselect" token="sourcetype" searchWhenChanged="true">
<label>Source Types</label>
<choice value="splunkd">splunkd</choice>
<choice value="splunk_web_access">splunk_web_access</choice>
<choice value="scheduler">scheduler</choice>
<default>splunkd,splunk_web_access</default>
<delimiter>,</delimiter>
</input>
</fieldset>
<row>
<panel>
<chart>
<title>Sourcetype Distribution</title>
<search>
<query>index=_internal [| gentimes start=-1 | eval sourcetype="$sourcetype$" | table sourcetype | makemv sourcetype delim="," | mvexpand sourcetype ]| timechart count by sourcetype</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">line</option>
<option name="charting.legend.placement">right</option>
<drilldown>
<link>
<![CDATA[
/app/search/multiselect_dropdown?form.sourcetype=$click.name2$
]]>
</link>
</drilldown>
</chart>
</panel>
</row>
</form>