Dashboards & Visualizations

How to reference other inputs in multiselect's dynamic query

Loves-to-Learn Everything

Hi folks,

I am creating a Splunk dashboard and have some questions regarding the multiselect input.

1. I want to add a special option `all`, when user selects it, means all options are selected. So I added a static option `all`, but I can select both `all` and any other options, makes it looks odd, so my first question is how to make `all` option either exclusive of other options, or when i select `all`, all options will be selected automatically (except `all`)?

2. For the multiselect input, I am currently using is int a `WHERE` clause: `| where $multiselect_roles$`, currently the configuration of multiselect is:


it means the interpolated clause looks like: `| where role_name="value1" OR role_name="value2"`, my second question is when `all` is selected, how can I either emit the whole `WHERE` clause, or make it trivial, means the `WHERE` clause is there but actually it doesn’t filter anything? I tried to give the `all` option an empty string, or a `*` but both don’t work. 

3. When populating the dynamic options of multiselect from query, I want to reference other inputs as query parameters.

For example, I already added an input whose token name is `environment` and another time range input, I want to only get distinct values of a column from the given environment and time range, like this:

`from_index_distapps` sourcetype="xyz" "request=" earliest=$time_range$
| rex field=message "request=\"(?[^}]+})"
| eval arjson=replace(arjson, "\\\\\"", "\"")
| spath input=arjson
| where environment=$environment$
| table role_name
| dedup role_name

How to correctly reference other inputs here? 

Labels (2)
0 Karma


Set your multi-select something like this

      <input type="multiselect" token="roles">
        <label>Select one or more roles</label>
        <choice value="All">All</choice>
        <search base="find_roles">
          <query>dedup roles | table roles</query>
        <delimiter> OR </delimiter>
          <eval token="form.roles">case(mvcount('form.roles')=0,"All",mvcount('form.roles')&gt;1 AND mvfind('form.roles',"All")&gt;0,"All",mvcount('form.roles')&gt;1 AND mvfind('form.roles',"All")=0,mvfilter('form.roles'!="All"),1==1,'form.roles')</eval>
          <eval token="multiselect_roles">if(mvfind('form.roles',"All")=0,"role=*",$roles$)</eval>

Note that the eval with the case statement has to be all on one line. Also, note that the value for All is All since it is the value not the label that is held in form.roles not the label. 

0 Karma

Loves-to-Learn Everything

PS why are the backquotes not covered into <code> </code> automatically?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...