I have 3 multiselects and each dependent on one-another.
The third multiselect should display panels based on the selection.
How do I give multiple query and conditions?
eg.,
Multiselect A
Multiselect B is dependent on A
Multiselect C is dependent on B
Panel 1 is dependent on C's selection.
Hi paviach
you have to create the searches of multiselect B and C as a search with a token from the previous multiselects, e.g. something like this:
Multiselect A (there's a field called fieldA):
| inputlookup lookupA.csv
| sort fieldA
| table fieldA
Multiselect B (there are two fields called fieldB and keyB, where keyB is the field related to Multiselect A):
| inputlookup lookupB.csv WHERE keyB=$fieldA$
| sort fieldB
| table fieldB
Multiselect C (there are three fields called fieldC, keyCA and keyCB, where keyCA is the field related to Multiselect A and keyCB is the field related to Multiselect B):
| inputlookup lookupC.csv WHERE (keyCA=$fieldA$ AND keyCB=$fieldB$)
| sort fieldC
| table fieldC
Ciao.
Giuseppe
Hi paviach
you have to create the searches of multiselect B and C as a search with a token from the previous multiselects, e.g. something like this:
Multiselect A (there's a field called fieldA):
| inputlookup lookupA.csv
| sort fieldA
| table fieldA
Multiselect B (there are two fields called fieldB and keyB, where keyB is the field related to Multiselect A):
| inputlookup lookupB.csv WHERE keyB=$fieldA$
| sort fieldB
| table fieldB
Multiselect C (there are three fields called fieldC, keyCA and keyCB, where keyCA is the field related to Multiselect A and keyCB is the field related to Multiselect B):
| inputlookup lookupC.csv WHERE (keyCA=$fieldA$ AND keyCB=$fieldB$)
| sort fieldC
| table fieldC
Ciao.
Giuseppe
I have created 2 multiselects and the 2nd works with 1st multiselect's input. Now based on B's selection, I need to display a panel. How do I do it?
Could you please give me a working sample? Am completely new to Splunk and trying hard to make this multiselect work for panels.
Hi paviach
try this, only to see the approach:
<form>
<label>test</label>
<fieldset submitButton="false">
<input type="dropdown" token="input1">
<label>Input1</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search>
<query>index=_internal | dedup sourcetype | sort sourcetype | table sourcetype</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<prefix>sourcetype="</prefix>
<suffix>"</suffix>
</input>
<input type="dropdown" token="input2">
<label>Input2</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>component</fieldForLabel>
<fieldForValue>component</fieldForValue>
<search>
<query>index=_internal $input1$ | dedup component | sort component | table component</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<prefix>component="</prefix>
<suffix>"</suffix>
</input>
</fieldset>
<row>
<panel>
<event>
<search>
<query>index=_internal $input1$ $input2$</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="list.drilldown">none</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="rowNumbers">0</option>
<option name="table.drilldown">all</option>
<option name="table.sortDirection">asc</option>
<option name="table.wrap">1</option>
<option name="type">list</option>
</event>
</panel>
</row>
</form>
Ciao.
Giuseppe