Multiple multiselects and panels

[paviach]

I have 3 multiselects and each dependent on one-another.
The third multiselect should display panels based on the selection.
How do I give multiple query and conditions?

eg.,
Multiselect A
Multiselect B is dependent on A
Multiselect C is dependent on B

Panel 1 is dependent on C's selection.

[gcusello · Accepted solution]

Hi paviach
you have to create the searches of multiselect B and C as a search with a token from the previous multiselects, e.g. something like this:

Multiselect A (there's a field called fieldA):

| inputlookup lookupA.csv
| sort fieldA
| table fieldA

Multiselect B (there are two fields called fieldB and keyB, where keyB is the field related to Multiselect A):

| inputlookup lookupB.csv WHERE keyB=$fieldA$
| sort fieldB
| table fieldB

Multiselect C (there are three fields called fieldC, keyCA and keyCB, where keyCA is the field related to Multiselect A and keyCB is the field related to Multiselect B):

| inputlookup lookupC.csv WHERE (keyCA=$fieldA$ AND keyCB=$fieldB$)
| sort fieldC
| table fieldC

Ciao.
Giuseppe

[paviach]

I have created 2 multiselects and the 2nd works with 1st multiselect's input. Now based on B's selection, I need to display a panel. How do I do it?

[paviach]

Could you please give me a working sample? Am completely new to Splunk and trying hard to make this multiselect work for panels.

[gcusello]

Hi paviach
try this, only to see the approach:

<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="input1">
      <label>Input1</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_internal | dedup sourcetype | sort sourcetype | table sourcetype</query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <prefix>sourcetype="</prefix>
      <suffix>"</suffix>
    </input>
    <input type="dropdown" token="input2">
      <label>Input2</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>component</fieldForLabel>
      <fieldForValue>component</fieldForValue>
      <search>
        <query>index=_internal $input1$ | dedup component | sort component | table component</query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <prefix>component="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>index=_internal $input1$ $input2$</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="list.drilldown">none</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.sortDirection">asc</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
      </event>
    </panel>
  </row>
</form>

Ciao.
Giuseppe