Dashboards & Visualizations

How to have multiple values in a token

bryceweb22
Path Finder

I am looking for a way to have my token in a multiselect dropdown pass two values into the search to increase the chances of generating more accurate results, please help.

Thanks!

0 Karma

vnravikumar
Champion

Hi

Check this sample

<form>
  <label>multiselect</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="field1">
      <label>field1</label>
      <valuePrefix>method="</valuePrefix>
      <delimiter> OR </delimiter>
      <valueSuffix>"</valueSuffix>
      <fieldForLabel>method</fieldForLabel>
      <fieldForValue>method</fieldForValue>
      <search>
        <query>index="_internal" sourcetype=splunkd_ui_access |stats count by method</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index="_internal" $field1$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

bryceweb22
Path Finder

Okay so I added the OR in the delimiter but where do I add my second value at because I tried doing it after the first one and no results were found.

0 Karma

vnravikumar
Champion

You need to consider these

 <valuePrefix>method="</valuePrefix>
       <delimiter> OR </delimiter>
       <valueSuffix>"</valueSuffix>

Finally, it constructed as index="_internal" method="DELETE" OR method="HEAD"

0 Karma

bryceweb22
Path Finder

Okay well I need it to be like this example

ModuleId=490 OR LevelId=70

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...