Dashboards & Visualizations

How to display multi select value on the title of a panel

RRajneesh
New Member

Hello,

I want only the value of my multi select to appear on the title of the panel. But actually, both the technical field name along with the value is getting displayed.

Can you please help ?

Thanks.

King Regards,
Rajneesh.

Tags (1)
0 Karma

mayurr98
Super Champion

Try this run anywhere XML

<form>
  <label>Sample Multiselect panel title</label>
  <fieldset>
    <input type="multiselect" token="log_level">
      <label>log_level</label>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>log_level</fieldForLabel>
      <fieldForValue>log_level</fieldForValue>
      <search>
        <query>index=_internal 
|  dedup log_level 
|  table log_level</query>
        <earliest>@d</earliest>
        <latest>now</latest>
      </search>
      <delimiter>,</delimiter>
    </input>
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Entrée/Sortie/Backlog - $log_level$</title>
        <search>
          <query>index=_internal log_level IN ($log_level$)</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
        <option name="charting.axisTitleX.text">Semaine</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.text">Ticket</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisY2.enabled">1</option>
        <option name="charting.axisY2.scale">log</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.columnSpacing">10</option>
        <option name="charting.chart.overlayFields">Backlog</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.fieldColors">{"Entrée": 0xFF0000, "Sortie": #008000 , "Backlog":0x0066FF}</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
      </chart>
    </panel>
  </row>
</form>

You would need to do some changes in search query and multiselect filter XML.
your multiselect should be

<input type="multiselect" token="problem_mapping">
      <label>log_level</label>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>problem_mapping</fieldForLabel>
      <fieldForValue>problem_mapping</fieldForValue>
      <search>
     <query>sourcetype=aiam_itsm_ticket_stesofiproteo1 | dedup problem_mapping | table problem_mapping | sort problem_mapping</query>
     <earliest>0</earliest>
     <latest></latest>
   </search>
      <delimiter>,</delimiter>
    </input>

and in panel your search query should be something like this

problem_mapping  IN ($problem_mapping$)

which is equivalent to problem_mapping=value1 OR problem_mapping=value2 OR problem_mapping=value3 and so on..

DalJeanis
Legend

Note - for posterity's sake, you should probably note what Splunk release this is valid on.

IIRC, I believe the IN syntax became available in 6.6.

For 6.5 and below, you'd use something like this...

   <label>log_level</label>
   <choice value="*">All</choice>
   <default>*</default>
   <initialValue>*</initialValue>
   <fieldForLabel>log_level</fieldForLabel>
   <fieldForValue>log_level</fieldForValue>
   <search>
     <query>index=_internal
         | stats count by log_level 
         | table log_level
     </query>
     <earliest>@d</earliest>
     <latest>now</latest>
   </search>    

   <prefix>(</prefix>
   <valuePrefix>log_level="</valuePrefix>
   <valueSuffix>"</valueSuffix>
   <delimiter> OR </delimiter>
   <suffix>)</suffix>

And the query would have this...

     <query>index=_internal  $log_level$</query>
0 Karma

mayurr98
Super Champion

It would be better if you post the XML and expected output for your code.

0 Karma

RRajneesh
New Member

Hi,

My multiselect :

  <label>Avril / TMA</label>
  <choice value="*">All</choice>
  <default>*</default>
  <initialValue>*</initialValue>
  <fieldForLabel>problem_mapping</fieldForLabel>
  <fieldForValue>problem_mapping</fieldForValue>
  <search>
    <query>sourcetype=aiam_itsm_ticket_stesofiproteo1 | dedup problem_mapping | table problem_mapping | sort problem_mapping</query>
    <earliest>0</earliest>
    <latest></latest>
  </search>
  <delimiter> OR </delimiter>
  <prefix>(</prefix>
  <valuePrefix>problem_mapping="</valuePrefix>
  <valueSuffix>"</valueSuffix>
  <suffix>)</suffix>
</input>

My panel :

<panel>
  <chart>
    <title>Entrée/Sortie/Backlog - $problem_mapping$ </title>
    <search>
      <query>* I HAVE MY QUERY HERE*</query>
      <earliest>$time.earliest$</earliest>
      <latest>$time.latest$</latest>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
    <option name="charting.axisTitleX.text">Semaine</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Ticket</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisY2.enabled">1</option>
    <option name="charting.axisY2.scale">log</option>
    <option name="charting.chart">column</option>
    <option name="charting.chart.overlayFields">Backlog</option>
    <option name="charting.chart.showDataLabels">all</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.drilldown">none</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.placement">bottom</option>
    <option name="charting.fieldColors">
      {"Entrée": 0xFF0000, "Sortie": #008000 , "Backlog":0x0066FF}
    </option>
    <option name="charting.chart.columnSpacing">10</option>
    <option name="trellis.enabled">0</option>
  </chart>
</panel>

Thanks.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...