Dashboards & Visualizations

How tokenize Multi-select value in a token <set>?

caarroniz
Engager

Hello All,

I am building a dashboard in which I have a Checkbox to trigger a different search when it gets enabled, so this is how my xml looks like:

 

<input type="multiselect" token="multiselect_value" searchWhenChanged="true">
  <search>
   <query>
     |inputlookup myFile.csv | fields values
   </query>
  </search>
<delimiter> OR </delimiter>
<valuePrefix>ServiceName</valuePrefix>
<valueSuffix>"</valueSuffix>
<prefix>(</prefix>
<suffix>)</suffix>
<choise value="*">ALL</choice>
<initialValue>*</initialValue>
</input>
<input  type="checkbox" token="test_checkbox">
  <choise value="true">Enable</choise>
  <change>
     <condition match="$test_checkbox$=&quot;true&quot;">
      <set token=base_query>
       "normal search without any token"
      </set>
   </condition>
   <condition>
    <set token=base_query>
     "search with a token inside" $multiselect_value$
    </set>
   </condition>
  </change>
</input>

 

 

Now, the problem is that the $multiselect_value$ is never taken, I already tried to use the <![CDATA[$multiselect_value$]]> but is not working, is there any other way to do this? if not how could you suggest to tokenize these queries in the condition?

 

Thanks in advance! 😄

Labels (2)
0 Karma
1 Solution

DalJeanis
Legend

if the searches are otherwise identical, then you can just use the multiselect value with the n token to avoid formatting it,  and set the value to a single space when you don't want it to contain anything of significance.

Your search would look more or less like this:

     "search with a token inside" $multiselect_value2|n$

And the checkbox like this: 

<input  type="checkbox" token="test_checkbox">
  <choise value="true">Enable</choise>
  <change>
     <condition match="$test_checkbox$=&quot;true&quot;">
      <set token="multiselect_value2">$multiselect_value$</set>
   </condition>
   <condition>
    <set token="multiselect_value2"></set>
   </condition>
  </change>
</input>

 

That could be made slightly simpler, but that would work.

View solution in original post

0 Karma

DalJeanis
Legend

if the searches are otherwise identical, then you can just use the multiselect value with the n token to avoid formatting it,  and set the value to a single space when you don't want it to contain anything of significance.

Your search would look more or less like this:

     "search with a token inside" $multiselect_value2|n$

And the checkbox like this: 

<input  type="checkbox" token="test_checkbox">
  <choise value="true">Enable</choise>
  <change>
     <condition match="$test_checkbox$=&quot;true&quot;">
      <set token="multiselect_value2">$multiselect_value$</set>
   </condition>
   <condition>
    <set token="multiselect_value2"></set>
   </condition>
  </change>
</input>

 

That could be made slightly simpler, but that would work.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...