Dashboards & Visualizations

How tokenize Multi-select value in a token <set>?

caarroniz
Engager

Hello All,

I am building a dashboard in which I have a Checkbox to trigger a different search when it gets enabled, so this is how my xml looks like:

 

<input type="multiselect" token="multiselect_value" searchWhenChanged="true">
  <search>
   <query>
     |inputlookup myFile.csv | fields values
   </query>
  </search>
<delimiter> OR </delimiter>
<valuePrefix>ServiceName</valuePrefix>
<valueSuffix>"</valueSuffix>
<prefix>(</prefix>
<suffix>)</suffix>
<choise value="*">ALL</choice>
<initialValue>*</initialValue>
</input>
<input  type="checkbox" token="test_checkbox">
  <choise value="true">Enable</choise>
  <change>
     <condition match="$test_checkbox$=&quot;true&quot;">
      <set token=base_query>
       "normal search without any token"
      </set>
   </condition>
   <condition>
    <set token=base_query>
     "search with a token inside" $multiselect_value$
    </set>
   </condition>
  </change>
</input>

 

 

Now, the problem is that the $multiselect_value$ is never taken, I already tried to use the <![CDATA[$multiselect_value$]]> but is not working, is there any other way to do this? if not how could you suggest to tokenize these queries in the condition?

 

Thanks in advance! 😄

Labels (2)
0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

if the searches are otherwise identical, then you can just use the multiselect value with the n token to avoid formatting it,  and set the value to a single space when you don't want it to contain anything of significance.

Your search would look more or less like this:

     "search with a token inside" $multiselect_value2|n$

And the checkbox like this: 

<input  type="checkbox" token="test_checkbox">
  <choise value="true">Enable</choise>
  <change>
     <condition match="$test_checkbox$=&quot;true&quot;">
      <set token="multiselect_value2">$multiselect_value$</set>
   </condition>
   <condition>
    <set token="multiselect_value2"></set>
   </condition>
  </change>
</input>

 

That could be made slightly simpler, but that would work.

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

if the searches are otherwise identical, then you can just use the multiselect value with the n token to avoid formatting it,  and set the value to a single space when you don't want it to contain anything of significance.

Your search would look more or less like this:

     "search with a token inside" $multiselect_value2|n$

And the checkbox like this: 

<input  type="checkbox" token="test_checkbox">
  <choise value="true">Enable</choise>
  <change>
     <condition match="$test_checkbox$=&quot;true&quot;">
      <set token="multiselect_value2">$multiselect_value$</set>
   </condition>
   <condition>
    <set token="multiselect_value2"></set>
   </condition>
  </change>
</input>

 

That could be made slightly simpler, but that would work.

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...