Dashboards & Visualizations

How use multiselect to pass multiple selected values to second drop down and to dashboard panels (Pivots and charts)

sanjeevt
Explorer

I have two multi select drop downs. When I select one or more from first drop down, the second drop down should populate accordingly and at the same time need to pass values to Pivots and charts of dashboard panels.

When I select more than one item form first multiselect I see 'search produced no results'

Please someone give me an idea. My code looks like as below

Dynamic Multi Select Support

<input type="time" token="time_token">
  <label>Select Time Range</label>
  <default>
    <earliest>-15m</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="multiselect" token="selected_host" searchWhenChanged="true">
  <label>Select the Host</label>
  <search>
    <query>index=temptesting_007 | stats count by host | sort limit=100 host</query>
    <earliest>-7d@h</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>host</fieldForLabel>
  <fieldForValue>host</fieldForValue>
  <delimiter> , </delimiter>
</input>
<input type="multiselect" token="source_type" searchWhenChanged="false">
  <label>Select Log Type</label>
  <search>
    <query>index=temptesting_007 host= $selected_host$ | stats count by sourcetype | sort limit=100 sourcetype</query>
    <earliest>0</earliest>
    <latest></latest>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>sourcetype</fieldForValue>
  <delimiter>,</delimiter>
  <choice value="*">ALL</choice>
</input>


<panel>
  <single>
    <search>
      <query>| pivot My_Model_2 My_Root_Search_Object count(My_Root_Search_Object) AS "Count of Logs"  FILTER host in ($selected_host$) FILTER sourcetype in ($source_type$) ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1</query>
      <earliest>$time_token.earliest$</earliest>
      <latest>$time_token.latest$</latest>
    </search>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="numberPrecision">0</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="unitPosition">after</option>
    <option name="useColors">0</option>
    <option name="useThousandSeparators">1</option>
    <option name="linkView">search</option>
    <option name="list.drilldown">full</option>
    <option name="list.wrap">1</option>
    <option name="maxLines">5</option>
    <option name="raw.drilldown">full</option>
    <option name="rowNumbers">0</option>
    <option name="table.drilldown">all</option>
    <option name="table.wrap">1</option>
    <option name="type">list</option>
    <fields>["host","source","sourcetype"]</fields>
    <option name="drilldown">none</option>
  </single>
</panel>
<panel>
  <table>
    <search>
      <query>| pivot My_Model_2 My_Root_Search_Object count(My_Root_Search_Object) AS "Count of My Root Search Object" SPLITROW host AS Host SPLITROW sourcetype AS "Source Type" FILTER host in ($selected_host$) FILTER sourcetype in ($source_type$) SORT 100 host ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1</query>
      <earliest>$time_token.earliest$</earliest>
      <latest>$time_token.latest$</latest>
    </search>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
    <option name="count">10</option>
  </table>
</panel>
1 Solution

lguinn2
Legend

The syntax in line 22 is wrong. If you have selected "hostA" and "hostB" in the first multiselect, the query in line 22 becomes

index=temptesting_007 host= hostA , hostB | stats count by sourcetype | sort limit=100 sourcetype

Starting with Splunk 6.6, you can use the following syntax:

index=temptesting_007 host IN ( $selected_host$ ) | stats count by sourcetype | sort limit=100 sourcetype

View solution in original post

sanjeevt
Explorer

Thank you . It worked

0 Karma

rjthibod
Champion

Please "Accept" the other answer and change this thread to a comment. You currently have it posted as an answer.

0 Karma

lguinn2
Legend

The syntax in line 22 is wrong. If you have selected "hostA" and "hostB" in the first multiselect, the query in line 22 becomes

index=temptesting_007 host= hostA , hostB | stats count by sourcetype | sort limit=100 sourcetype

Starting with Splunk 6.6, you can use the following syntax:

index=temptesting_007 host IN ( $selected_host$ ) | stats count by sourcetype | sort limit=100 sourcetype

paritoshs24
Path Finder

Dude !!!!! Your answer saved my life !! 😘 

0 Karma

maxiveil
Engager

Make sure to write "IN" in capital letters otherwise it won't work. 

skoelpin
SplunkTrust
SplunkTrust

This works perfectly for me, thanks @lguinn !

rjthibod
Champion

hey @lguinn, when did the search format <FIELD> IN (...) get introduced for base searches? That is new to me.

0 Karma

rjthibod
Champion

Nevermind, I found the note in the SPL docs for the search command. Looks like it is new to 6.6. That is super helpful.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...