Dashboards & Visualizations

How to create multiple Values for Static Option on Multiselect field?

macfredough
Explorer

Hello,

I am rather new to Splunk and I have two values that I want to search for, but I want to combine them to one name in multiselect option (easier for user).   

There are two coded values for offsite sample and onsite samples which are 

offsite samples = "OffsiteComplete" and "OffsiteNeedsReview"

onsite samples = "QA Approved" and "Analysis Complete"

I have tried to add these both as values and use OR as delimiter but no success.  Please help!  Code is below and screenshot

macfredough_0-1692135549931.png

 

<form>
<label>LIMS Analytical Data</label>
<description>Select Year Range First</description>
<search>
<query>| makeresults
| add info
</query>
<earliest>$time_token1.earliest$</earliest>
<latest>$time_token1.latest$</latest>
<done>
<eval token="tokEarliestTimeString">strftime($result.info_min_time$,"%Y/%m/%d %H:%M:%S %p")</eval>
<eval token="tokLatestTimeString">if($result.info_max_time$="+Infinity",strftime(relative_time(now(),"0d"),"%Y/%m/%d %H:%M:%S %p"),strftime($result.info_max_time$,"%Y/%m/%d %H:%M:%S %p")</eval>
<eval token="tokEarliestTime">$result.info_min_time$</eval>
<eval token="tokLatestTime">if($result.info_max_time$="+Infinity",relative_time(now(),"0d"),$result.info_max_time$)</eval>
</done>
</search>
<fieldset submitButton="true">
<input type="dropdown" token="lookupToken" searchWhenChanged="true">
<label>Year Range</label>
<choice value="LIMSCSV.csv">2022-2023</choice>
<choice value="LIMS2021.csv">2021</choice>
<choice value="LIMS2020.csv">2020</choice>
<choice value="LIMS2019.csv">2019</choice>
<choice value="LIMSPre2019.csv">Pre-2019</choice>
<default>LIMSCSV.csv</default>
<initialValue>LIMSCSV.csv</initialValue>
</input>
<input type="time" token="time_token1" searchWhenChanged="true">
<label>Select Time Range within Year Range</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="multiselect" token="lab_token" searchWhenChanged="true">
<label>Result Status</label>
<delimiter> OR </delimiter>
<search>
<query/>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<choice value="OffsiteComplete,OffsiteNeedsReview">Offsite Analysis</choice>
<choice value="QA Approved">Onsite Analysis</choice>
<valuePrefix>ResultStatus="</valuePrefix>
<valueSuffix>"</valueSuffix>
</input>
<input type="multiselect" token="analyte_token" searchWhenChanged="true">
<label>Select Analyte</label>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>Analyte="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>Analyte</fieldForLabel>
<fieldForValue>Analyte</fieldForValue>
<search>
<query>|inputlookup $lookupToken$
|where _time &lt;= $tokLatestTime$
|where _time &gt;= $tokEarliestTime$
|where $lab_token$
|stats count by Analyte</query>
</search>

 

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can do it like this using IN(a,b,c) for the options

    <input type="multiselect" token="lab_token" searchWhenChanged="true">
      <label>Result Status</label>
      <delimiter>,</delimiter>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <choice value="OffsiteComplete,OffsiteNeedsReview">Offsite Analysis</choice>
      <choice value="QA Approved">Onsite Analysis</choice>
      <valuePrefix></valuePrefix>
      <valueSuffix>,</valueSuffix>
      <prefix>ResultStatus IN(</prefix>
      <suffix>)</suffix>
    </input>

 This will give you a trailing comma, but it has no impact. I'm assuming that ResultStats can by ONE of any of the options you want or did you mean that ResultStatus can actually be OffsiteComplete,OffsiteNeedsReview?

And I assume you're missing the Analysis Complete from the Onsite Analysis?

macfredough
Explorer

Thanks for your response.  I have tried the code, but I am still getting an error on the next multiselect field, stating that "could not create search".  Here is code past that of lab_token and screen shot of dashboard.

 

<input type="multiselect" token="lab_token" searchWhenChanged="true">
      <label>Result Status</label>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <choice value="Offsite Complete,OffsiteNeedsReview">Offsite Analysis</choice>
      <choice value="QA Approved,Analysis Approved">Onsite Analysis</choice>
      <valueSuffix>,</valueSuffix>
      <prefix>ResultStatus IN(</prefix>
      <suffix>)</suffix>
      <delimiter> </delimiter>
    </input>
    <input type="multiselect" token="analyte_token" searchWhenChanged="true">
      <label>Select Analyte</label>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>Analyte="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>Analyte</fieldForLabel>
      <fieldForValue>Analyte</fieldForValue>
      <search>
        <query>|inputlookup $lookupToken$ 
            |where _time &lt;= $tokLatestTime$
            |where _time &gt;= $tokEarliestTime$ 
            |where  $lab_token$
             |stats count by Analyte</query>
      </search>

 

macfredough_0-1692205929648.png

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

The <search> fragment should not be in your XML - it looks like you have configured it to run an empty search - just remove that.

macfredough
Explorer

Thanks for your help, I was able to get this to work!!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...