Dashboards & Visualizations

How to create multiple Values for Static Option on Multiselect field?

macfredough
Explorer

Hello,

I am rather new to Splunk and I have two values that I want to search for, but I want to combine them to one name in multiselect option (easier for user).   

There are two coded values for offsite sample and onsite samples which are 

offsite samples = "OffsiteComplete" and "OffsiteNeedsReview"

onsite samples = "QA Approved" and "Analysis Complete"

I have tried to add these both as values and use OR as delimiter but no success.  Please help!  Code is below and screenshot

macfredough_0-1692135549931.png

 

<form>
<label>LIMS Analytical Data</label>
<description>Select Year Range First</description>
<search>
<query>| makeresults
| add info
</query>
<earliest>$time_token1.earliest$</earliest>
<latest>$time_token1.latest$</latest>
<done>
<eval token="tokEarliestTimeString">strftime($result.info_min_time$,"%Y/%m/%d %H:%M:%S %p")</eval>
<eval token="tokLatestTimeString">if($result.info_max_time$="+Infinity",strftime(relative_time(now(),"0d"),"%Y/%m/%d %H:%M:%S %p"),strftime($result.info_max_time$,"%Y/%m/%d %H:%M:%S %p")</eval>
<eval token="tokEarliestTime">$result.info_min_time$</eval>
<eval token="tokLatestTime">if($result.info_max_time$="+Infinity",relative_time(now(),"0d"),$result.info_max_time$)</eval>
</done>
</search>
<fieldset submitButton="true">
<input type="dropdown" token="lookupToken" searchWhenChanged="true">
<label>Year Range</label>
<choice value="LIMSCSV.csv">2022-2023</choice>
<choice value="LIMS2021.csv">2021</choice>
<choice value="LIMS2020.csv">2020</choice>
<choice value="LIMS2019.csv">2019</choice>
<choice value="LIMSPre2019.csv">Pre-2019</choice>
<default>LIMSCSV.csv</default>
<initialValue>LIMSCSV.csv</initialValue>
</input>
<input type="time" token="time_token1" searchWhenChanged="true">
<label>Select Time Range within Year Range</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="multiselect" token="lab_token" searchWhenChanged="true">
<label>Result Status</label>
<delimiter> OR </delimiter>
<search>
<query/>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<choice value="OffsiteComplete,OffsiteNeedsReview">Offsite Analysis</choice>
<choice value="QA Approved">Onsite Analysis</choice>
<valuePrefix>ResultStatus="</valuePrefix>
<valueSuffix>"</valueSuffix>
</input>
<input type="multiselect" token="analyte_token" searchWhenChanged="true">
<label>Select Analyte</label>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>Analyte="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>Analyte</fieldForLabel>
<fieldForValue>Analyte</fieldForValue>
<search>
<query>|inputlookup $lookupToken$
|where _time &lt;= $tokLatestTime$
|where _time &gt;= $tokEarliestTime$
|where $lab_token$
|stats count by Analyte</query>
</search>

 

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can do it like this using IN(a,b,c) for the options

    <input type="multiselect" token="lab_token" searchWhenChanged="true">
      <label>Result Status</label>
      <delimiter>,</delimiter>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <choice value="OffsiteComplete,OffsiteNeedsReview">Offsite Analysis</choice>
      <choice value="QA Approved">Onsite Analysis</choice>
      <valuePrefix></valuePrefix>
      <valueSuffix>,</valueSuffix>
      <prefix>ResultStatus IN(</prefix>
      <suffix>)</suffix>
    </input>

 This will give you a trailing comma, but it has no impact. I'm assuming that ResultStats can by ONE of any of the options you want or did you mean that ResultStatus can actually be OffsiteComplete,OffsiteNeedsReview?

And I assume you're missing the Analysis Complete from the Onsite Analysis?

macfredough
Explorer

Thanks for your response.  I have tried the code, but I am still getting an error on the next multiselect field, stating that "could not create search".  Here is code past that of lab_token and screen shot of dashboard.

 

<input type="multiselect" token="lab_token" searchWhenChanged="true">
      <label>Result Status</label>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <choice value="Offsite Complete,OffsiteNeedsReview">Offsite Analysis</choice>
      <choice value="QA Approved,Analysis Approved">Onsite Analysis</choice>
      <valueSuffix>,</valueSuffix>
      <prefix>ResultStatus IN(</prefix>
      <suffix>)</suffix>
      <delimiter> </delimiter>
    </input>
    <input type="multiselect" token="analyte_token" searchWhenChanged="true">
      <label>Select Analyte</label>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>Analyte="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>Analyte</fieldForLabel>
      <fieldForValue>Analyte</fieldForValue>
      <search>
        <query>|inputlookup $lookupToken$ 
            |where _time &lt;= $tokLatestTime$
            |where _time &gt;= $tokEarliestTime$ 
            |where  $lab_token$
             |stats count by Analyte</query>
      </search>

 

macfredough_0-1692205929648.png

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

The <search> fragment should not be in your XML - it looks like you have configured it to run an empty search - just remove that.

macfredough
Explorer

Thanks for your help, I was able to get this to work!!

0 Karma
Get Updates on the Splunk Community!

Splunk Certification Support Alert | Pearson VUE Outage

Splunk Certification holders and candidates!  Please be advised of an upcoming system maintenance period for ...

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...