Dashboards & Visualizations

How tokenize Multi-select value in a token <set>?

caarroniz
Engager

Hello All,

I am building a dashboard in which I have a Checkbox to trigger a different search when it gets enabled, so this is how my xml looks like:

 

<input type="multiselect" token="multiselect_value" searchWhenChanged="true">
  <search>
   <query>
     |inputlookup myFile.csv | fields values
   </query>
  </search>
<delimiter> OR </delimiter>
<valuePrefix>ServiceName</valuePrefix>
<valueSuffix>"</valueSuffix>
<prefix>(</prefix>
<suffix>)</suffix>
<choise value="*">ALL</choice>
<initialValue>*</initialValue>
</input>
<input  type="checkbox" token="test_checkbox">
  <choise value="true">Enable</choise>
  <change>
     <condition match="$test_checkbox$=&quot;true&quot;">
      <set token=base_query>
       "normal search without any token"
      </set>
   </condition>
   <condition>
    <set token=base_query>
     "search with a token inside" $multiselect_value$
    </set>
   </condition>
  </change>
</input>

 

 

Now, the problem is that the $multiselect_value$ is never taken, I already tried to use the <![CDATA[$multiselect_value$]]> but is not working, is there any other way to do this? if not how could you suggest to tokenize these queries in the condition?

 

Thanks in advance! 😄

Labels (2)
0 Karma
1 Solution

DalJeanis
Legend

if the searches are otherwise identical, then you can just use the multiselect value with the n token to avoid formatting it,  and set the value to a single space when you don't want it to contain anything of significance.

Your search would look more or less like this:

     "search with a token inside" $multiselect_value2|n$

And the checkbox like this: 

<input  type="checkbox" token="test_checkbox">
  <choise value="true">Enable</choise>
  <change>
     <condition match="$test_checkbox$=&quot;true&quot;">
      <set token="multiselect_value2">$multiselect_value$</set>
   </condition>
   <condition>
    <set token="multiselect_value2"></set>
   </condition>
  </change>
</input>

 

That could be made slightly simpler, but that would work.

View solution in original post

0 Karma

DalJeanis
Legend

if the searches are otherwise identical, then you can just use the multiselect value with the n token to avoid formatting it,  and set the value to a single space when you don't want it to contain anything of significance.

Your search would look more or less like this:

     "search with a token inside" $multiselect_value2|n$

And the checkbox like this: 

<input  type="checkbox" token="test_checkbox">
  <choise value="true">Enable</choise>
  <change>
     <condition match="$test_checkbox$=&quot;true&quot;">
      <set token="multiselect_value2">$multiselect_value$</set>
   </condition>
   <condition>
    <set token="multiselect_value2"></set>
   </condition>
  </change>
</input>

 

That could be made slightly simpler, but that would work.

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...