Dashboards & Visualizations

How to reference other inputs in multiselect's dynamic query

codewarrior
Loves-to-Learn Everything

Hi folks,

I am creating a Splunk dashboard and have some questions regarding the multiselect input.

1. I want to add a special option `all`, when user selects it, means all options are selected. So I added a static option `all`, but I can select both `all` and any other options, makes it looks odd, so my first question is how to make `all` option either exclusive of other options, or when i select `all`, all options will be selected automatically (except `all`)?

2. For the multiselect input, I am currently using is int a `WHERE` clause: `| where $multiselect_roles$`, currently the configuration of multiselect is:

codewarrior_0-1632529389700.png

it means the interpolated clause looks like: `| where role_name="value1" OR role_name="value2"`, my second question is when `all` is selected, how can I either emit the whole `WHERE` clause, or make it trivial, means the `WHERE` clause is there but actually it doesn’t filter anything? I tried to give the `all` option an empty string, or a `*` but both don’t work. 

3. When populating the dynamic options of multiselect from query, I want to reference other inputs as query parameters.

For example, I already added an input whose token name is `environment` and another time range input, I want to only get distinct values of a column from the given environment and time range, like this:

`from_index_distapps` sourcetype="xyz" "request=" earliest=$time_range$
| rex field=message "request=\"(?[^}]+})"
| eval arjson=replace(arjson, "\\\\\"", "\"")
| spath input=arjson
| where environment=$environment$
| table role_name
| dedup role_name

How to correctly reference other inputs here? 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Set your multi-select something like this

      <input type="multiselect" token="roles">
        <label>Select one or more roles</label>
        <choice value="All">All</choice>
        <search base="find_roles">
          <query>dedup roles | table roles</query>
        </search>
        <fieldForLabel>roles</fieldForLabel>
        <fieldForValue>roles</fieldForValue>
        <prefix>(</prefix>
        <valuePrefix>role="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <delimiter> OR </delimiter>
        <suffix>)</suffix>
        <default>All</default>
        <change>
          <eval token="form.roles">case(mvcount('form.roles')=0,"All",mvcount('form.roles')&gt;1 AND mvfind('form.roles',"All")&gt;0,"All",mvcount('form.roles')&gt;1 AND mvfind('form.roles',"All")=0,mvfilter('form.roles'!="All"),1==1,'form.roles')</eval>
          <eval token="multiselect_roles">if(mvfind('form.roles',"All")=0,"role=*",$roles$)</eval>
        </change>
      </input>

Note that the eval with the case statement has to be all on one line. Also, note that the value for All is All since it is the value not the label that is held in form.roles not the label. 

0 Karma

codewarrior
Loves-to-Learn Everything

PS why are the backquotes not covered into <code> </code> automatically?

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...