Dashboards & Visualizations

Multiselect Tokens not passing values

Mary666
Communicator

Hello All,

I need to have the multiselect  for Application Name apply its value to the Server Status Multiselect. I have a token for Application Name and have been able to pass it to the other multiselects, but I cant seem to pass it for the Server Status. Any advise would greatly help. 

 

<form theme="light">
   <label>Sample Dashboard</label>
   <fieldset submitButton="false">
      <input type="multiselect" token="tok_ApplicationName" searchWhenChanged="true">
         <label>Application Name</label>
         <choice value="*">All</choice>
         <fieldForLabel>Application Name</fieldForLabel>
         <fieldForValue>ApplicationName</fieldForValue>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Application Name" as ApplicationName | stats count by ApplicationName</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <delimiter>OR</delimiter>
         <default>*</default>
         <prefix>(</prefix>
         <suffix>)</suffix>
         <valuePrefix>ApplicationName="</valuePrefix>
         <valueSuffix>"</valueSuffix>
      </input>
      <input type="multiselect" token="tok_ServerName" searchWhenChanged="true">
         <label>Server Name</label>
         <choice value="*">All</choice>
         <fieldForLabel>Server Name</fieldForLabel>
         <fieldForValue>ServerName</fieldForValue>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Domain Name" as ServerName "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by ServerName | table ServerName</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <delimiter>OR</delimiter>
         <default>*</default>
         <prefix>(</prefix>
         <suffix>)</suffix>
         <valuePrefix>ServerName="</valuePrefix>
         <valueSuffix>"</valueSuffix>
      </input>
      <input type="multiselect" token="tok_ServerStatus" searchWhenChanged="true">
         <label>Server Status</label>
         <choice value="*">All</choice>
         <fieldForLabel>Status</fieldForLabel>
         <fieldForValue>Status</fieldForValue>
         <search>
            <query>| inputlookup SPL_Server_Status.csv | rename "Application" as ApplicationName | search $tok_ApplicationName$ | stats count by Status | table Status</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <delimiter>OR</delimiter>
         <default>All</default>
         <prefix>(</prefix>
         <suffix>)</suffix>
         <valuePrefix>Status="</valuePrefix>
         <valueSuffix>"</valueSuffix>
      </input>
      <input type="multiselect" token="tok_ServerNature" searchWhenChanged="true">
         <label>Server Nature</label>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Server Nature" as ServerNature "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by ServerNature | table ServerNature</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <default>All</default>
         <prefix>(</prefix>
         <valuePrefix>ServerNature="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>Server Nature</fieldForLabel>
         <fieldForValue>ServerNature</fieldForValue>
      </input>
      <input type="multiselect" token="tok_DeploymentName" searchWhenChanged="true">
         <label>Deployment Name</label>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Deployment Name" as deploymentName "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by deploymentName | table deploymentName</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <default>All</default>
         <prefix>(</prefix>
         <valuePrefix>deploymentName="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>Deployment Name</fieldForLabel>
         <fieldForValue>deploymentName</fieldForValue>
      </input>
      <input type="multiselect" token="tok_Location" searchWhenChanged="true">
         <label>Location</label>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by Location | table Location</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <default>All</default>
         <prefix>(</prefix>
         <valuePrefix>Location="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>Location</fieldForLabel>
         <fieldForValue>Location</fieldForValue>
      </input>
      <input type="multiselect" token="tok_OS" searchWhenChanged="true">
         <label>O.S</label>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Operating System" as OS "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by OS</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <default>All</default>
         <prefix>(</prefix>
         <valuePrefix>OS="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>O.S</fieldForLabel>
         <fieldForValue>OS</fieldForValue>
      </input>
      <input type="multiselect" token="tok_CompName" searchWhenChanged="true">
         <label>Component Name</label>
         <!-- <default>All</default> -->
         <prefix>(</prefix>
         <valuePrefix>ComponentName="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>Component Name</fieldForLabel>
         <fieldForValue>ComponentName</fieldForValue>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Component Name" as ComponentName "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by ComponentName</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <!-- <choice value="*">All</choice>
<suffix>)</suffix> -->
         <default>*</default>
      </input>
   </fieldset>
   <row>
      <panel>
         <title>Server Count $tok_count$</title>
         <html>
            <style>.dashboard-row .dashboard-panel h2.panel-title {
background:PALEGOLDENROD !important;
color:black !important;
font-size: 16px !important;
font-family:Helvetica, sans-serif !important;
text-align: center !important;
font-weight: bold !important;
}</style>
            <div />
         </html>
         <table>
            <search>
               <progress>
                  <set token="tok_count">$job.resultCount$</set>
               </progress>
               <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Deployment Name" as deploymentName "Server Name" as ServerName "Server Nature" as ServerNature "Operating System" as OS "Application Name" as ApplicationName "Component Name" as ComponentName | lookup SPL_Server_Status.csv Server_Name as ServerName OUTPUT Status | fillnull ApplicationName ComponentName Location ServerName ServerNature OS deploymentName Status value=NULL | search $tok_DeploymentName$ $tok_ServerName$ $tok_ServerNature$ $tok_Location$ $tok_OS$ $tok_ApplicationName$ $tok_CompName$ $tok_ServerStatus$ | stats values(Status) as "Server Status" values(ApplicationName) as "Application Name", values(ServerNature) as "Server Nature", values(deploymentName) as "Deployment Name", values(Location) as Location, values(ComponentName) as "Component Name" values(OS) as "O.S" by ServerName | sort ServerName</query>
               <earliest>-15m</earliest>
               <latest>now</latest>
            </search>
            <option name="drilldown">none</option>
         </table>
      </panel>
   </row>
</form>

 

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mary666,

the only thing I see is the delimiter, try to add a space before and after OR:

<delimiter> OR </delimiter>

Ciao.

Giuseppe

0 Karma

renjith_nair
Legend

Please use code sample (</>) to post your code for better readability. I have formatted and updated it for now.

Could you please explain what exactly the problem is? Are you getting any error or the values are not detected correctly ?

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

Mary666
Communicator

Hello,

I have made some edits to my code and have fixed a few issues along the way. However, I am still not able to pass the Application Name token over to the Server Status input box. I would appriciate any leads.

 

 

 

<form theme="light">
  <label>Example Dashboard</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="tok_ApplicationName" searchWhenChanged="true">
      <label>Application Name</label>
      <choice value="*">All</choice>
      <fieldForLabel>Application Name</fieldForLabel>
      <fieldForValue>ApplicationName</fieldForValue>
      <search>
        <query>  | inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ]  | rename "Application Name"  as ApplicationName  | stats count by ApplicationName   </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <delimiter>OR </delimiter>
      <default>*</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>ApplicationName="</valuePrefix>
      <valueSuffix>"</valueSuffix>
    </input>
    <input type="multiselect" token="tok_ServerName" searchWhenChanged="true">
      <label>Server Name</label>
      <choice value="*">All</choice>
      <fieldForLabel>Server Name</fieldForLabel>
      <fieldForValue>ServerName</fieldForValue>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "FQM" as ServerName "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by ServerName  | table ServerName  </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <delimiter>OR </delimiter>
      <default>*</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>ServerName="</valuePrefix>
      <valueSuffix>"</valueSuffix>
    </input>
    <input type="multiselect" token="tok_ServerStatus" searchWhenChanged="true">
      <label>Server Status</label>
      <choice value="*">All</choice>
      <fieldForLabel>Server Status</fieldForLabel>
      <fieldForValue>Status</fieldForValue>
      <search>
        <query>  | inputlookup XYZ_Server_Status.csv  | inputlookup append=t ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv   | rename  "Application" as ApplicationName  "Server_Name" as ServerName | search $tok_ApplicationName$  | stats count by Status   | table Status  </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <delimiter> OR </delimiter>
      <default>All</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>Status="</valuePrefix>
      <valueSuffix>"</valueSuffix>
    </input>
    <input type="multiselect" token="tok_ServerNature" searchWhenChanged="true">
      <label>Server Nature</label>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Server Nature" as ServerNature "Application Name"  as ApplicationName | search $tok_ApplicationName$ | stats count by ServerNature   | table ServerNature   </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <default>All</default>
      <prefix>(</prefix>
      <valuePrefix>ServerNature="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>Server Nature</fieldForLabel>
      <fieldForValue>ServerNature</fieldForValue>
    </input>
    <input type="multiselect" token="tok_DeploymentName" searchWhenChanged="true">
      <label>Deployment Name</label>
      <search>
        <query> | inputlookup ABC_Toys_Report.csv  | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Deployment Name" as deploymentName "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by deploymentName  | table deploymentName   </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <default>All</default>
      <prefix>(</prefix>
      <valuePrefix>deploymentName="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>Deployment Name</fieldForLabel>
      <fieldForValue>deploymentName</fieldForValue>
    </input>
    <input type="multiselect" token="tok_Location" searchWhenChanged="true">
      <label>Location</label>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by Location  | table Location  </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <default>All</default>
      <prefix>(</prefix>
      <valuePrefix>Location="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>Location</fieldForLabel>
      <fieldForValue>Location</fieldForValue>
    </input>
    <input type="multiselect" token="tok_OS" searchWhenChanged="true">
      <label>O.S</label>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Operating System" as OS "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by OS</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <default>All</default>
      <prefix>(</prefix>
      <valuePrefix>OS="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>O.S</fieldForLabel>
      <fieldForValue>OS</fieldForValue>
    </input>
    <input type="multiselect" token="tok_CompName" searchWhenChanged="true">
      <label>Component Name</label>
      <!-- <default>All</default> -->
      <prefix>(</prefix>
      <valuePrefix>ComponentName="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>OR</delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>Component Name</fieldForLabel>
      <fieldForValue>ComponentName</fieldForValue>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Component Name" as ComponentName "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by ComponentName</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <!--  <choice value="*">All</choice>
      <suffix>)</suffix>  -->
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Server Count $tok_count$</title>
      <html>
        <style>
       .dashboard-row .dashboard-panel h2.panel-title {
             background:PALEGOLDENROD  !important;
             color:black !important;
             font-size: 16px !important;
             font-family:Helvetica, sans-serif !important;
             text-align: center !important;
             font-weight: bold !important;
           }

        </style>
        <div/>
      </html>
      <table>
        <search>
          <progress>
            <set token="tok_count">$job.resultCount$</set>
          </progress>
          <query>  | inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv   | rename "Deployment Name" as deploymentName "FQM" as ServerName "Server Name" as ServerName "Server Nature" as ServerNature   "Operating System" as OS "Application Name" as ApplicationName  "Component Name" as ComponentName  | lookup XYZ_Server_Status.csv Server_Name as ServerName OUTPUT Status  | fillnull ApplicationName ComponentName Location ServerName ServerNature OS deploymentName Status value=NULL   | search  $tok_DeploymentName$ $tok_ServerName$ $tok_ServerNature$   $tok_Location$ $tok_OS$ $tok_ApplicationName$ $tok_CompName$ $tok_ServerStatus$ | stats values(Status) as "Server Status" values(ApplicationName) as "Application Name",  values(ServerNature) as "Server Nature", values(deploymentName) as "Deployment Name", values(Location) as Location, values(ComponentName) as "Component Name" values(OS) as "O.S" by ServerName | sort  ServerName   </query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mary666,

another thing, the search in the multiselect it's strange: you can use | inputlookup only at the beginning of a search (or a sub search), you cannot use more inputlookups one after one.

Wjhat do you want to list in that search?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...