Dashboards & Visualizations

How to reference other inputs in multiselect's dynamic query

codewarrior
Loves-to-Learn Lots

Hi folks,

I am creating a Splunk dashboard and have some questions regarding the multiselect input.

1. I want to add a special option `all`, when user selects it, means all options are selected. So I added a static option `all`, but I can select both `all` and any other options, makes it looks odd, so my first question is how to make `all` option either exclusive of other options, or when i select `all`, all options will be selected automatically (except `all`)?

2. For the multiselect input, I am currently using is int a `WHERE` clause: `| where $multiselect_roles$`, currently the configuration of multiselect is:

codewarrior_0-1632529389700.png

it means the interpolated clause looks like: `| where role_name="value1" OR role_name="value2"`, my second question is when `all` is selected, how can I either emit the whole `WHERE` clause, or make it trivial, means the `WHERE` clause is there but actually it doesn’t filter anything? I tried to give the `all` option an empty string, or a `*` but both don’t work. 

3. When populating the dynamic options of multiselect from query, I want to reference other inputs as query parameters.

For example, I already added an input whose token name is `environment` and another time range input, I want to only get distinct values of a column from the given environment and time range, like this:

`from_index_distapps` sourcetype="xyz" "request=" earliest=$time_range$
| rex field=message "request=\"(?[^}]+})"
| eval arjson=replace(arjson, "\\\\\"", "\"")
| spath input=arjson
| where environment=$environment$
| table role_name
| dedup role_name

How to correctly reference other inputs here? 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Set your multi-select something like this

      <input type="multiselect" token="roles">
        <label>Select one or more roles</label>
        <choice value="All">All</choice>
        <search base="find_roles">
          <query>dedup roles | table roles</query>
        </search>
        <fieldForLabel>roles</fieldForLabel>
        <fieldForValue>roles</fieldForValue>
        <prefix>(</prefix>
        <valuePrefix>role="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <delimiter> OR </delimiter>
        <suffix>)</suffix>
        <default>All</default>
        <change>
          <eval token="form.roles">case(mvcount('form.roles')=0,"All",mvcount('form.roles')&gt;1 AND mvfind('form.roles',"All")&gt;0,"All",mvcount('form.roles')&gt;1 AND mvfind('form.roles',"All")=0,mvfilter('form.roles'!="All"),1==1,'form.roles')</eval>
          <eval token="multiselect_roles">if(mvfind('form.roles',"All")=0,"role=*",$roles$)</eval>
        </change>
      </input>

Note that the eval with the case statement has to be all on one line. Also, note that the value for All is All since it is the value not the label that is held in form.roles not the label. 

0 Karma

codewarrior
Loves-to-Learn Lots

PS why are the backquotes not covered into <code> </code> automatically?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!