Dashboards & Visualizations

How use multiselect to pass multiple selected values to second drop down and to dashboard panels (Pivots and charts)

sanjeevt
New Member

I have two multi select drop downs. When I select one or more from first drop down, the second drop down should populate accordingly and at the same time need to pass values to Pivots and charts of dashboard panels.

When I select more than one item form first multiselect I see 'search produced no results'

Please someone give me an idea. My code looks like as below

Dynamic Multi Select Support

<input type="time" token="time_token">
  <label>Select Time Range</label>
  <default>
    <earliest>-15m</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="multiselect" token="selected_host" searchWhenChanged="true">
  <label>Select the Host</label>
  <search>
    <query>index=temptesting_007 | stats count by host | sort limit=100 host</query>
    <earliest>-7d@h</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>host</fieldForLabel>
  <fieldForValue>host</fieldForValue>
  <delimiter> , </delimiter>
</input>
<input type="multiselect" token="source_type" searchWhenChanged="false">
  <label>Select Log Type</label>
  <search>
    <query>index=temptesting_007 host= $selected_host$ | stats count by sourcetype | sort limit=100 sourcetype</query>
    <earliest>0</earliest>
    <latest></latest>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>sourcetype</fieldForValue>
  <delimiter>,</delimiter>
  <choice value="*">ALL</choice>
</input>


<panel>
  <single>
    <search>
      <query>| pivot My_Model_2 My_Root_Search_Object count(My_Root_Search_Object) AS "Count of Logs"  FILTER host in ($selected_host$) FILTER sourcetype in ($source_type$) ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1</query>
      <earliest>$time_token.earliest$</earliest>
      <latest>$time_token.latest$</latest>
    </search>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="numberPrecision">0</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="unitPosition">after</option>
    <option name="useColors">0</option>
    <option name="useThousandSeparators">1</option>
    <option name="linkView">search</option>
    <option name="list.drilldown">full</option>
    <option name="list.wrap">1</option>
    <option name="maxLines">5</option>
    <option name="raw.drilldown">full</option>
    <option name="rowNumbers">0</option>
    <option name="table.drilldown">all</option>
    <option name="table.wrap">1</option>
    <option name="type">list</option>
    <fields>["host","source","sourcetype"]</fields>
    <option name="drilldown">none</option>
  </single>
</panel>
<panel>
  <table>
    <search>
      <query>| pivot My_Model_2 My_Root_Search_Object count(My_Root_Search_Object) AS "Count of My Root Search Object" SPLITROW host AS Host SPLITROW sourcetype AS "Source Type" FILTER host in ($selected_host$) FILTER sourcetype in ($source_type$) SORT 100 host ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1</query>
      <earliest>$time_token.earliest$</earliest>
      <latest>$time_token.latest$</latest>
    </search>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
    <option name="count">10</option>
  </table>
</panel>
0 Karma
1 Solution

lguinn2
Legend

The syntax in line 22 is wrong. If you have selected "hostA" and "hostB" in the first multiselect, the query in line 22 becomes

index=temptesting_007 host= hostA , hostB | stats count by sourcetype | sort limit=100 sourcetype

Starting with Splunk 6.6, you can use the following syntax:

index=temptesting_007 host IN ( $selected_host$ ) | stats count by sourcetype | sort limit=100 sourcetype

View solution in original post

sanjeevt
New Member

Thank you . It worked

0 Karma

rjthibod
Champion

Please "Accept" the other answer and change this thread to a comment. You currently have it posted as an answer.

0 Karma

lguinn2
Legend

The syntax in line 22 is wrong. If you have selected "hostA" and "hostB" in the first multiselect, the query in line 22 becomes

index=temptesting_007 host= hostA , hostB | stats count by sourcetype | sort limit=100 sourcetype

Starting with Splunk 6.6, you can use the following syntax:

index=temptesting_007 host IN ( $selected_host$ ) | stats count by sourcetype | sort limit=100 sourcetype

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

This works perfectly for me, thanks @lguinn !

0 Karma

rjthibod
Champion

hey @lguinn, when did the search format <FIELD> IN (...) get introduced for base searches? That is new to me.

0 Karma

rjthibod
Champion

Nevermind, I found the note in the SPL docs for the search command. Looks like it is new to 6.6. That is super helpful.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.