How to display results for several users using a multi-select dropdown on a dashboard?

[matthew_foos]

Splunkers,

I'm trying to display the results for several users using a multi-select dropdown on a dashboard. The results for one user will display correctly. When I add a second, third, fourth, etc user, I get no results found.

Here is the SPL for the panel:

index=trn5 source="*trn5/logs/system/access.log" NOT user="SYSUSER" NOT user="-" NOT user="USER01" NOT user="USER03" NOT user="USER04" NOT user="user10" NOT user="user11" NOT user="b12663"
| lookup cis_users.csv userid AS user
| search username="$input_user2$"
| eval day=strftime(_time, "%B %d %Y") 
| eventstats range(_time) AS duration BY username day
| stats values(duration) as duration by username day
| eval duration=tostring(duration, "duration")
| rename username as User, day as Date, duration as "Time in Portal"

SPL for the dropdown:

index=trn5 
 | lookup cis_users.csv userid AS user
 | fields username
 | table username
 | dedup username
 | sort 0 username

Field for Label: username
Field for Value: username

[gcusello · Accepted solution]

Hi matthew.foos,
how do you configured multi select dropdown? did you remember to put " OR " (with spaces)
in other word in the multiselect you need

  <valuePrefix>username="</valuePrefix>
  <delimiter> OR </delimiter>
  <default>*</default>
  <valueSuffix>"</valueSuffix>

then in the search you have to insert

| search $input_user2$

in this way you can manage the multi selection otherwise you can use only one value.

One additional information: use OUTPUT in lookup command

Bye.
Giuseppe

[matthew_foos]

Nailed it.

[kmaron]

can you share the XML for your dropdown?

[matthew_foos]

  <input type="multiselect" token="input_user2" searchWhenChanged="true">
    <label>Select a User(s):</label>
    <fieldForLabel>username</fieldForLabel>
    <fieldForValue>username</fieldForValue>
    <search>
      <query>index=trn5 

| lookup cis_users.csv userid AS user
| fields username
| table username
| dedup username
| sort 0 username
-30d@d
now

[kmaron]

It looks like you're missing the OR setup. @cusello mentioned it below