How to create multiple Values for Static Option on Multiselect field?

[macfredough]

Hello,

I am rather new to Splunk and I have two values that I want to search for, but I want to combine them to one name in multiselect option (easier for user).   

There are two coded values for offsite sample and onsite samples which are 

offsite samples = "OffsiteComplete" and "OffsiteNeedsReview"

onsite samples = "QA Approved" and "Analysis Complete"

I have tried to add these both as values and use OR as delimiter but no success.  Please help!  Code is below and screenshot

<form>
<label>LIMS Analytical Data</label>
<description>Select Year Range First</description>
<search>
<query>| makeresults
| add info
</query>
<earliest>$time_token1.earliest$</earliest>
<latest>$time_token1.latest$</latest>
<done>
<eval token="tokEarliestTimeString">strftime($result.info_min_time$,"%Y/%m/%d %H:%M:%S %p")</eval>
<eval token="tokLatestTimeString">if($result.info_max_time$="+Infinity",strftime(relative_time(now(),"0d"),"%Y/%m/%d %H:%M:%S %p"),strftime($result.info_max_time$,"%Y/%m/%d %H:%M:%S %p")</eval>
<eval token="tokEarliestTime">$result.info_min_time$</eval>
<eval token="tokLatestTime">if($result.info_max_time$="+Infinity",relative_time(now(),"0d"),$result.info_max_time$)</eval>
</done>
</search>
<fieldset submitButton="true">
<input type="dropdown" token="lookupToken" searchWhenChanged="true">
<label>Year Range</label>
<choice value="LIMSCSV.csv">2022-2023</choice>
<choice value="LIMS2021.csv">2021</choice>
<choice value="LIMS2020.csv">2020</choice>
<choice value="LIMS2019.csv">2019</choice>
<choice value="LIMSPre2019.csv">Pre-2019</choice>
<default>LIMSCSV.csv</default>
<initialValue>LIMSCSV.csv</initialValue>
</input>
<input type="time" token="time_token1" searchWhenChanged="true">
<label>Select Time Range within Year Range</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="multiselect" token="lab_token" searchWhenChanged="true">
<label>Result Status</label>
<delimiter> OR </delimiter>
<search>
<query/>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<choice value="OffsiteComplete,OffsiteNeedsReview">Offsite Analysis</choice>
<choice value="QA Approved">Onsite Analysis</choice>
<valuePrefix>ResultStatus="</valuePrefix>
<valueSuffix>"</valueSuffix>
</input>
<input type="multiselect" token="analyte_token" searchWhenChanged="true">
<label>Select Analyte</label>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>Analyte="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>Analyte</fieldForLabel>
<fieldForValue>Analyte</fieldForValue>
<search>
<query>|inputlookup $lookupToken$
|where _time &lt;= $tokLatestTime$
|where _time &gt;= $tokEarliestTime$
|where $lab_token$
|stats count by Analyte</query>
</search>

[bowesmana]

You can do it like this using IN(a,b,c) for the options

    <input type="multiselect" token="lab_token" searchWhenChanged="true">
      <label>Result Status</label>
      <delimiter>,</delimiter>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <choice value="OffsiteComplete,OffsiteNeedsReview">Offsite Analysis</choice>
      <choice value="QA Approved">Onsite Analysis</choice>
      <valuePrefix></valuePrefix>
      <valueSuffix>,</valueSuffix>
      <prefix>ResultStatus IN(</prefix>
      <suffix>)</suffix>
    </input>

 This will give you a trailing comma, but it has no impact. I'm assuming that ResultStats can by ONE of any of the options you want or did you mean that ResultStatus can actually be OffsiteComplete,OffsiteNeedsReview?

And I assume you're missing the Analysis Complete from the Onsite Analysis?

[macfredough]

Thanks for your response.  I have tried the code, but I am still getting an error on the next multiselect field, stating that "could not create search".  Here is code past that of lab_token and screen shot of dashboard.

<input type="multiselect" token="lab_token" searchWhenChanged="true">
      <label>Result Status</label>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <choice value="Offsite Complete,OffsiteNeedsReview">Offsite Analysis</choice>
      <choice value="QA Approved,Analysis Approved">Onsite Analysis</choice>
      <valueSuffix>,</valueSuffix>
      <prefix>ResultStatus IN(</prefix>
      <suffix>)</suffix>
      <delimiter> </delimiter>
    </input>
    <input type="multiselect" token="analyte_token" searchWhenChanged="true">
      <label>Select Analyte</label>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>Analyte="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>Analyte</fieldForLabel>
      <fieldForValue>Analyte</fieldForValue>
      <search>
        <query>|inputlookup $lookupToken$ 
            |where _time &lt;= $tokLatestTime$
            |where _time &gt;= $tokEarliestTime$ 
            |where  $lab_token$
             |stats count by Analyte</query>
      </search>

[bowesmana]

The <search> fragment should not be in your XML - it looks like you have configured it to run an empty search - just remove that.

[macfredough]

Thanks for your help, I was able to get this to work!!