Multiple values on a static value for a Dashboard ...

molehu · ‎07-10-2021

Hello,

I would like to have a Multiselect field on a dashboard and want to add options to group values on the drop down list.

For example, I want to have options options like:
All states
Western states
Eastern states
AL
AK
...

where I want to define "Western states" as CA or OR or WA.
Can you illustrate the proper syntax then for this option so when "Western states" is selected, it would do an OR on CA or OR or WA? Thank you.

<choice value="CA ???????">Western states</choice>

Code:
<input type="multiselect" token="state" searchWhenChanged="true">
<label>States</label>
<fieldForLabel>stcode</fieldForLabel>
<fieldForValue>stcode</fieldForValue>
<search>
<query>|inputlookup somelookup | dedup stcode | sort stcode</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<valuePrefix>stcode="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<choice value="*">All states</choice>
<choice value="CA ???????">Western states</choice>
</input>

kamlesh_vaghela · ‎07-10-2021

@molehu

Can you please try this sample code?

<form>
  <label>Stcode Multiselect</label>
  <search>
          <query>| makeresults | eval selected_state="$form.state$",stcode=split(selected_state,",")| mvexpand stcode | fields stcode | format | table search</query>
          <done>
            <set token="selected_state">$result.search$</set>
          </done>
        </search>
  <fieldset submitButton="false">
    <input type="multiselect" token="state">
      <label>field1</label>
      <fieldForLabel>stcode</fieldForLabel>
      <fieldForValue>stcode</fieldForValue>
      <search>
        <query>| makeresults | eval _raw="stcode
AL
AK
CA
OR
WA" | multikv forceheader=1 | fields stcode</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <choice value="*">All states</choice>
      <choice value="CA,OR,WA">Western states</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $selected_state$
      </html>
    </panel>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval _raw="stcode
AL
AK
CA
OR
WA" | multikv forceheader=1 | search  $selected_state$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Multiple values on a static value for a Dashboard Multiselect field

Dashboard Studio

Index This | What is broken 80% of the time by February?

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Join the Conversation

Multiple values on a static value for a Dashboard Multiselect field

Dashboard Studio

Index This | What is broken 80% of the time by February?

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Splunk MCP & Agentic AI: Machine Data Without Limits