Dashboards & Visualizations

How tokenize Multi-select value in a token <set>?

caarroniz
Engager

Hello All,

I am building a dashboard in which I have a Checkbox to trigger a different search when it gets enabled, so this is how my xml looks like:

 

<input type="multiselect" token="multiselect_value" searchWhenChanged="true">
  <search>
   <query>
     |inputlookup myFile.csv | fields values
   </query>
  </search>
<delimiter> OR </delimiter>
<valuePrefix>ServiceName</valuePrefix>
<valueSuffix>"</valueSuffix>
<prefix>(</prefix>
<suffix>)</suffix>
<choise value="*">ALL</choice>
<initialValue>*</initialValue>
</input>
<input  type="checkbox" token="test_checkbox">
  <choise value="true">Enable</choise>
  <change>
     <condition match="$test_checkbox$=&quot;true&quot;">
      <set token=base_query>
       "normal search without any token"
      </set>
   </condition>
   <condition>
    <set token=base_query>
     "search with a token inside" $multiselect_value$
    </set>
   </condition>
  </change>
</input>

 

 

Now, the problem is that the $multiselect_value$ is never taken, I already tried to use the <![CDATA[$multiselect_value$]]> but is not working, is there any other way to do this? if not how could you suggest to tokenize these queries in the condition?

 

Thanks in advance! 😄

Labels (2)
0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

if the searches are otherwise identical, then you can just use the multiselect value with the n token to avoid formatting it,  and set the value to a single space when you don't want it to contain anything of significance.

Your search would look more or less like this:

     "search with a token inside" $multiselect_value2|n$

And the checkbox like this: 

<input  type="checkbox" token="test_checkbox">
  <choise value="true">Enable</choise>
  <change>
     <condition match="$test_checkbox$=&quot;true&quot;">
      <set token="multiselect_value2">$multiselect_value$</set>
   </condition>
   <condition>
    <set token="multiselect_value2"></set>
   </condition>
  </change>
</input>

 

That could be made slightly simpler, but that would work.

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

if the searches are otherwise identical, then you can just use the multiselect value with the n token to avoid formatting it,  and set the value to a single space when you don't want it to contain anything of significance.

Your search would look more or less like this:

     "search with a token inside" $multiselect_value2|n$

And the checkbox like this: 

<input  type="checkbox" token="test_checkbox">
  <choise value="true">Enable</choise>
  <change>
     <condition match="$test_checkbox$=&quot;true&quot;">
      <set token="multiselect_value2">$multiselect_value$</set>
   </condition>
   <condition>
    <set token="multiselect_value2"></set>
   </condition>
  </change>
</input>

 

That could be made slightly simpler, but that would work.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...