Dashboards & Visualizations

How do I populate a multivalue input with itself during a drilldown?

thisissplunk
Builder

I have a few inputs at the top of my dashboard, one being a multivalue input. Its default is two values, but I often only have one value in there to filter the result show I'd like.

I then click on a field value in a random panel that reloads the dashboard page with the new selected data filtering the entire dashboard. However, this resets the multivalue input back to default. This is not what I want. I've tried this and it places values into the multivalue input instead, but incorrectly so, returning no results:

 <link field="filename">
            <![CDATA[
              /app/Splunk_Files_App/filedata_dashboard?form.filename=$click.value2$&form.index=$index$&form.filetype=$filetype$
            ]]>
 </link>

The problem is the multivalue $filetype$. It literally populates it with "file_type=exe" when I drilldown instead of "EXE".
Here is the multivalue input if needed:

<input type="multiselect" token="filetype" searchWhenChanged="true">
  <label>File name</label>
  <choice value="*">All</choice>
  <default>EXE,PDF</default>
  <search>
    <query>index=$index$ sourcetype=file_data | dedup file_type | table file_type</query>
    <earliest>$time.earliest$</earliest>
    <latest>$time.latest$</latest>
  </search>
  <fieldForLabel>file_type</fieldForLabel>
  <fieldForValue>file_type</fieldForValue>
  <!--      Build multi-selection search: 
  EX: (sourcetype ="value1" OR sourcetype ="value2" OR ...)
  -->
  <prefix>(</prefix>
  <valuePrefix>file_type="</valuePrefix>
  <valueSuffix>"</valueSuffix>
  <delimiter> OR </delimiter>
  <suffix>)</suffix>
</input>

tldr: I try to populate a multivalue input with itself during a drilldown and it doesn't work as expected. How do I do this?

somesoni2
Revered Legend

Try something like this (run anywhere example). See how the multiselect values are formatted (just with delimiter) and how they are used in the search (using subsearch to generate field=value1 OR field=value2... format)

<form>
  <label>Multiselect Dropdown</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="sourcetype" searchWhenChanged="true">
      <label>Source Types</label>
      <choice value="splunkd">splunkd</choice>
      <choice value="splunk_web_access">splunk_web_access</choice>
      <choice value="scheduler">scheduler</choice>
      <default>splunkd,splunk_web_access</default>
      <delimiter>,</delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Sourcetype Distribution</title>
        <search>
          <query>index=_internal [| gentimes start=-1 | eval sourcetype="$sourcetype$" | table sourcetype | makemv sourcetype delim="," | mvexpand sourcetype ]| timechart count by sourcetype</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>

        <option name="charting.legend.placement">right</option>
        <drilldown>
          <link>
            <![CDATA[
               /app/search/multiselect_dropdown?form.sourcetype=$click.name2$
             ]]>
          </link>
        </drilldown>        
      </chart>
    </panel>
  </row>
</form>
0 Karma
Get Updates on the Splunk Community!

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...