Multiple values on a static value for a Dashboard ...

molehu · ‎07-10-2021

Hello,

I would like to have a Multiselect field on a dashboard and want to add options to group values on the drop down list.

For example, I want to have options options like:
All states
Western states
Eastern states
AL
AK
...

where I want to define "Western states" as CA or OR or WA.
Can you illustrate the proper syntax then for this option so when "Western states" is selected, it would do an OR on CA or OR or WA? Thank you.

<choice value="CA ???????">Western states</choice>

Code:
<input type="multiselect" token="state" searchWhenChanged="true">
<label>States</label>
<fieldForLabel>stcode</fieldForLabel>
<fieldForValue>stcode</fieldForValue>
<search>
<query>|inputlookup somelookup | dedup stcode | sort stcode</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<valuePrefix>stcode="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<choice value="*">All states</choice>
<choice value="CA ???????">Western states</choice>
</input>

kamlesh_vaghela · ‎07-10-2021

@molehu

Can you please try this sample code?

<form>
  <label>Stcode Multiselect</label>
  <search>
          <query>| makeresults | eval selected_state="$form.state$",stcode=split(selected_state,",")| mvexpand stcode | fields stcode | format | table search</query>
          <done>
            <set token="selected_state">$result.search$</set>
          </done>
        </search>
  <fieldset submitButton="false">
    <input type="multiselect" token="state">
      <label>field1</label>
      <fieldForLabel>stcode</fieldForLabel>
      <fieldForValue>stcode</fieldForValue>
      <search>
        <query>| makeresults | eval _raw="stcode
AL
AK
CA
OR
WA" | multikv forceheader=1 | fields stcode</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <choice value="*">All states</choice>
      <choice value="CA,OR,WA">Western states</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $selected_state$
      </html>
    </panel>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval _raw="stcode
AL
AK
CA
OR
WA" | multikv forceheader=1 | search  $selected_state$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Multiple values on a static value for a Dashboard Multiselect field

Dashboard Studio

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation