Dashboards & Visualizations

How to resolve this Multiselect Filter Issue?

jason_hotchkiss
Communicator

I have the following XML

 

     <input type="multiselect" token="exclude_user" searchWhenChanged="true">
        <label>Exclude User</label>
        <valuePrefix>"</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <delimiter>, </delimiter>
        <fieldForLabel>user</fieldForLabel>
        <fieldForValue>user</fieldForValue>
        <search base="filtered">
          <query>| stats values(User) as user
| mvexpand user
| dedup user</query>
        </search>
        <choice value="SYSTEM">SYSTEM</choice>
        <choice value="-">NONE</choice>
        <default>SYSTEM</default>
        <initialValue>SYSTEM</initialValue>
      </input>

 


The filter is setup as an exclusion filter using a post processing search in conjunction with the base search, such as:

| search NOT User IN ($exclude_user$)

The multiselect works, until the value of "NONE" is selected which inputs the values of

| search NOT User IN (" ") into the post processing search.

Text below the filter displays, "Duplicate values causing conflict".  This doesn't prevent the search from completing, and the results I receive are what I expect to be returned.

It would be ideal for the message below the multiselect filter to not be displayed.  Anyone have a suggestion on how I can get rid of it?

I have tried the following:

Adding | dedup User to the post processing search.
Changing the fieldForLabel value to " " and NONE

Not sure what to try next.  Thanks in advanced.

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...