How use multiselect to pass multiple selected values to second drop down and to dashboard panels (Pivots and charts)

[sanjeevt]

I have two multi select drop downs. When I select one or more from first drop down, the second drop down should populate accordingly and at the same time need to pass values to Pivots and charts of dashboard panels.

When I select more than one item form first multiselect I see 'search produced no results'

Please someone give me an idea. My code looks like as below

Dynamic Multi Select Support

<input type="time" token="time_token">
  <label>Select Time Range</label>
  <default>
    <earliest>-15m</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="multiselect" token="selected_host" searchWhenChanged="true">
  <label>Select the Host</label>
  <search>
    <query>index=temptesting_007 | stats count by host | sort limit=100 host</query>
    <earliest>-7d@h</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>host</fieldForLabel>
  <fieldForValue>host</fieldForValue>
  <delimiter> , </delimiter>
</input>
<input type="multiselect" token="source_type" searchWhenChanged="false">
  <label>Select Log Type</label>
  <search>
    <query>index=temptesting_007 host= $selected_host$ | stats count by sourcetype | sort limit=100 sourcetype</query>
    <earliest>0</earliest>
    <latest></latest>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>sourcetype</fieldForValue>
  <delimiter>,</delimiter>
  <choice value="*">ALL</choice>
</input>


<panel>
  <single>
    <search>
      <query>| pivot My_Model_2 My_Root_Search_Object count(My_Root_Search_Object) AS "Count of Logs"  FILTER host in ($selected_host$) FILTER sourcetype in ($source_type$) ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1</query>
      <earliest>$time_token.earliest$</earliest>
      <latest>$time_token.latest$</latest>
    </search>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="numberPrecision">0</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="unitPosition">after</option>
    <option name="useColors">0</option>
    <option name="useThousandSeparators">1</option>
    <option name="linkView">search</option>
    <option name="list.drilldown">full</option>
    <option name="list.wrap">1</option>
    <option name="maxLines">5</option>
    <option name="raw.drilldown">full</option>
    <option name="rowNumbers">0</option>
    <option name="table.drilldown">all</option>
    <option name="table.wrap">1</option>
    <option name="type">list</option>
    <fields>["host","source","sourcetype"]</fields>
    <option name="drilldown">none</option>
  </single>
</panel>
<panel>
  <table>
    <search>
      <query>| pivot My_Model_2 My_Root_Search_Object count(My_Root_Search_Object) AS "Count of My Root Search Object" SPLITROW host AS Host SPLITROW sourcetype AS "Source Type" FILTER host in ($selected_host$) FILTER sourcetype in ($source_type$) SORT 100 host ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1</query>
      <earliest>$time_token.earliest$</earliest>
      <latest>$time_token.latest$</latest>
    </search>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
    <option name="count">10</option>
  </table>
</panel>

[sanjeevt]

Thank you . It worked

[rjthibod]

Please "Accept" the other answer and change this thread to a comment. You currently have it posted as an answer.

[lguinn2 · Accepted solution]

The syntax in line 22 is wrong. If you have selected "hostA" and "hostB" in the first multiselect, the query in line 22 becomes

index=temptesting_007 host= hostA , hostB | stats count by sourcetype | sort limit=100 sourcetype

Starting with Splunk 6.6, you can use the following syntax:

index=temptesting_007 host IN ( $selected_host$ ) | stats count by sourcetype | sort limit=100 sourcetype

[paritoshs24]

Dude !!!!! Your answer saved my life !! 😘 

[maxiveil]

Make sure to write "IN" in capital letters otherwise it won't work. 

[skoelpin]

This works perfectly for me, thanks @lguinn !

[rjthibod]

hey @lguinn, when did the search format <FIELD> IN (...) get introduced for base searches? That is new to me.

[rjthibod]

Nevermind, I found the note in the SPL docs for the search command. Looks like it is new to 6.6. That is super helpful.