Dashboards & Visualizations

How to extract table records with multi-select

kobayashines
New Member

Hello. I am Japanese. Please allow posting using google translation.

The following sources are created. This source works just by copying and pasting.

<form theme="light">
  <label>FilterTest</label>
  <search id="baseSearch">
    <query>
      | stats count
      | eval _raw="col1, col2, col3
         aaa,bbb,ccc
         ddd,eee,fff
         ggg,hhh,iii"
      | multikv forceheader=1
    </query>
  </search>
  <row>
    <panel>
      <input type="multiselect" token="TableValues">
      <label>TargetValues</label>
      <choice value="*">*</choice>
      <fieldForLabel>valueList</fieldForLabel>
      <fieldForValue>valueList</fieldForValue>
      <search base="baseSearch">
        <query>
          | stats values(col3) as valueList | mvexpand valueList
        </query>
      </search>
      <choice value="*">*</choice>
      <prefix>''</prefix>
    </input>
      <table>
        <search base="baseSearch">
          <query>
             | table col1 col2 col3
           </query>
        </search>
      </table>
    </panel>
  </row>
</form>

When you do this, the table is created as follows:
In addition, the text box lists the value of col3.

col1 col2 col3
aaa bbb ccc
ddd eee fff
ggg hhh iii

◆What i want to do
I want to select "ccc" and "iii" from the text box and extract the records containing this from col3.

How can I do that?

0 Karma
1 Solution

renjith_nair
Legend

@kobayashines ,

Try

<form>
  <label>FilterTest</label>
  <search id="baseSearch">
    <query>| stats count
       | eval _raw="col1, col2, col3
          aaa,bbb,ccc
          ddd,eee,fff
          ggg,hhh,iii"
       | multikv forceheader=1</query>
  </search>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="multiselect" token="TableValues">
        <label>TargetValues</label>
        <choice value="*">*</choice>
        <fieldForLabel>valueList</fieldForLabel>
        <fieldForValue>valueList</fieldForValue>
        <search base="baseSearch">
          <query>| stats values(col3) as valueList | mvexpand valueList</query>
        </search>
        <valuePrefix>col3="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <delimiter>  OR </delimiter>
        <prefix>(</prefix>
        <suffix>)</suffix>
        <default>*</default>
        <initialValue>*</initialValue>
      </input>
      <table>
        <search base="baseSearch">
          <query>|search $TableValues$| table col1 col2 col3</query>
        </search>
      </table>
    </panel>
  </row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@kobayashines ,

Try

<form>
  <label>FilterTest</label>
  <search id="baseSearch">
    <query>| stats count
       | eval _raw="col1, col2, col3
          aaa,bbb,ccc
          ddd,eee,fff
          ggg,hhh,iii"
       | multikv forceheader=1</query>
  </search>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="multiselect" token="TableValues">
        <label>TargetValues</label>
        <choice value="*">*</choice>
        <fieldForLabel>valueList</fieldForLabel>
        <fieldForValue>valueList</fieldForValue>
        <search base="baseSearch">
          <query>| stats values(col3) as valueList | mvexpand valueList</query>
        </search>
        <valuePrefix>col3="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <delimiter>  OR </delimiter>
        <prefix>(</prefix>
        <suffix>)</suffix>
        <default>*</default>
        <initialValue>*</initialValue>
      </input>
      <table>
        <search base="baseSearch">
          <query>|search $TableValues$| table col1 col2 col3</query>
        </search>
      </table>
    </panel>
  </row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

kobayashines
New Member

That is exactly what I wanted to do.
Thank you for the best answer!

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...