Re: Multiselect Tokens not passing values

Mary666 · ‎11-06-2020

Hello All,

I need to have the multiselect for Application Name apply its value to the Server Status Multiselect. I have a token for Application Name and have been able to pass it to the other multiselects, but I cant seem to pass it for the Server Status. Any advise would greatly help.

<form theme="light">
   <label>Sample Dashboard</label>
   <fieldset submitButton="false">
      <input type="multiselect" token="tok_ApplicationName" searchWhenChanged="true">
         <label>Application Name</label>
         <choice value="*">All</choice>
         <fieldForLabel>Application Name</fieldForLabel>
         <fieldForValue>ApplicationName</fieldForValue>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Application Name" as ApplicationName | stats count by ApplicationName</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <delimiter>OR</delimiter>
         <default>*</default>
         <prefix>(</prefix>
         <suffix>)</suffix>
         <valuePrefix>ApplicationName="</valuePrefix>
         <valueSuffix>"</valueSuffix>
      </input>
      <input type="multiselect" token="tok_ServerName" searchWhenChanged="true">
         <label>Server Name</label>
         <choice value="*">All</choice>
         <fieldForLabel>Server Name</fieldForLabel>
         <fieldForValue>ServerName</fieldForValue>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Domain Name" as ServerName "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by ServerName | table ServerName</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <delimiter>OR</delimiter>
         <default>*</default>
         <prefix>(</prefix>
         <suffix>)</suffix>
         <valuePrefix>ServerName="</valuePrefix>
         <valueSuffix>"</valueSuffix>
      </input>
      <input type="multiselect" token="tok_ServerStatus" searchWhenChanged="true">
         <label>Server Status</label>
         <choice value="*">All</choice>
         <fieldForLabel>Status</fieldForLabel>
         <fieldForValue>Status</fieldForValue>
         <search>
            <query>| inputlookup SPL_Server_Status.csv | rename "Application" as ApplicationName | search $tok_ApplicationName$ | stats count by Status | table Status</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <delimiter>OR</delimiter>
         <default>All</default>
         <prefix>(</prefix>
         <suffix>)</suffix>
         <valuePrefix>Status="</valuePrefix>
         <valueSuffix>"</valueSuffix>
      </input>
      <input type="multiselect" token="tok_ServerNature" searchWhenChanged="true">
         <label>Server Nature</label>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Server Nature" as ServerNature "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by ServerNature | table ServerNature</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <default>All</default>
         <prefix>(</prefix>
         <valuePrefix>ServerNature="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>Server Nature</fieldForLabel>
         <fieldForValue>ServerNature</fieldForValue>
      </input>
      <input type="multiselect" token="tok_DeploymentName" searchWhenChanged="true">
         <label>Deployment Name</label>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Deployment Name" as deploymentName "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by deploymentName | table deploymentName</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <default>All</default>
         <prefix>(</prefix>
         <valuePrefix>deploymentName="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>Deployment Name</fieldForLabel>
         <fieldForValue>deploymentName</fieldForValue>
      </input>
      <input type="multiselect" token="tok_Location" searchWhenChanged="true">
         <label>Location</label>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by Location | table Location</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <default>All</default>
         <prefix>(</prefix>
         <valuePrefix>Location="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>Location</fieldForLabel>
         <fieldForValue>Location</fieldForValue>
      </input>
      <input type="multiselect" token="tok_OS" searchWhenChanged="true">
         <label>O.S</label>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Operating System" as OS "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by OS</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <default>All</default>
         <prefix>(</prefix>
         <valuePrefix>OS="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>O.S</fieldForLabel>
         <fieldForValue>OS</fieldForValue>
      </input>
      <input type="multiselect" token="tok_CompName" searchWhenChanged="true">
         <label>Component Name</label>
         <!-- <default>All</default> -->
         <prefix>(</prefix>
         <valuePrefix>ComponentName="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>Component Name</fieldForLabel>
         <fieldForValue>ComponentName</fieldForValue>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Component Name" as ComponentName "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by ComponentName</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <!-- <choice value="*">All</choice>
<suffix>)</suffix> -->
         <default>*</default>
      </input>
   </fieldset>
   <row>
      <panel>
         <title>Server Count $tok_count$</title>
         <html>
            <style>.dashboard-row .dashboard-panel h2.panel-title {
background:PALEGOLDENROD !important;
color:black !important;
font-size: 16px !important;
font-family:Helvetica, sans-serif !important;
text-align: center !important;
font-weight: bold !important;
}</style>
            <div />
         </html>
         <table>
            <search>
               <progress>
                  <set token="tok_count">$job.resultCount$</set>
               </progress>
               <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Deployment Name" as deploymentName "Server Name" as ServerName "Server Nature" as ServerNature "Operating System" as OS "Application Name" as ApplicationName "Component Name" as ComponentName | lookup SPL_Server_Status.csv Server_Name as ServerName OUTPUT Status | fillnull ApplicationName ComponentName Location ServerName ServerNature OS deploymentName Status value=NULL | search $tok_DeploymentName$ $tok_ServerName$ $tok_ServerNature$ $tok_Location$ $tok_OS$ $tok_ApplicationName$ $tok_CompName$ $tok_ServerStatus$ | stats values(Status) as "Server Status" values(ApplicationName) as "Application Name", values(ServerNature) as "Server Nature", values(deploymentName) as "Deployment Name", values(Location) as Location, values(ComponentName) as "Component Name" values(OS) as "O.S" by ServerName | sort ServerName</query>
               <earliest>-15m</earliest>
               <latest>now</latest>
            </search>
            <option name="drilldown">none</option>
         </table>
      </panel>
   </row>
</form>

gcusello · ‎11-06-2020

Hi @Mary666,

the only thing I see is the delimiter, try to add a space before and after OR:

<delimiter> OR </delimiter>

Ciao.

Giuseppe

renjith_nair · ‎11-06-2020

Please use code sample (</>) to post your code for better readability. I have formatted and updated it for now.

Could you please explain what exactly the problem is? Are you getting any error or the values are not detected correctly ?

Happy Splunking!

Mary666 · ‎11-08-2020

Hello,

I have made some edits to my code and have fixed a few issues along the way. However, I am still not able to pass the Application Name token over to the Server Status input box. I would appriciate any leads.

<form theme="light">
  <label>Example Dashboard</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="tok_ApplicationName" searchWhenChanged="true">
      <label>Application Name</label>
      <choice value="*">All</choice>
      <fieldForLabel>Application Name</fieldForLabel>
      <fieldForValue>ApplicationName</fieldForValue>
      <search>
        <query>  | inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ]  | rename "Application Name"  as ApplicationName  | stats count by ApplicationName   </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <delimiter>OR </delimiter>
      <default>*</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>ApplicationName="</valuePrefix>
      <valueSuffix>"</valueSuffix>
    </input>
    <input type="multiselect" token="tok_ServerName" searchWhenChanged="true">
      <label>Server Name</label>
      <choice value="*">All</choice>
      <fieldForLabel>Server Name</fieldForLabel>
      <fieldForValue>ServerName</fieldForValue>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "FQM" as ServerName "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by ServerName  | table ServerName  </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <delimiter>OR </delimiter>
      <default>*</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>ServerName="</valuePrefix>
      <valueSuffix>"</valueSuffix>
    </input>
    <input type="multiselect" token="tok_ServerStatus" searchWhenChanged="true">
      <label>Server Status</label>
      <choice value="*">All</choice>
      <fieldForLabel>Server Status</fieldForLabel>
      <fieldForValue>Status</fieldForValue>
      <search>
        <query>  | inputlookup XYZ_Server_Status.csv  | inputlookup append=t ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv   | rename  "Application" as ApplicationName  "Server_Name" as ServerName | search $tok_ApplicationName$  | stats count by Status   | table Status  </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <delimiter> OR </delimiter>
      <default>All</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>Status="</valuePrefix>
      <valueSuffix>"</valueSuffix>
    </input>
    <input type="multiselect" token="tok_ServerNature" searchWhenChanged="true">
      <label>Server Nature</label>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Server Nature" as ServerNature "Application Name"  as ApplicationName | search $tok_ApplicationName$ | stats count by ServerNature   | table ServerNature   </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <default>All</default>
      <prefix>(</prefix>
      <valuePrefix>ServerNature="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>Server Nature</fieldForLabel>
      <fieldForValue>ServerNature</fieldForValue>
    </input>
    <input type="multiselect" token="tok_DeploymentName" searchWhenChanged="true">
      <label>Deployment Name</label>
      <search>
        <query> | inputlookup ABC_Toys_Report.csv  | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Deployment Name" as deploymentName "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by deploymentName  | table deploymentName   </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <default>All</default>
      <prefix>(</prefix>
      <valuePrefix>deploymentName="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>Deployment Name</fieldForLabel>
      <fieldForValue>deploymentName</fieldForValue>
    </input>
    <input type="multiselect" token="tok_Location" searchWhenChanged="true">
      <label>Location</label>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by Location  | table Location  </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <default>All</default>
      <prefix>(</prefix>
      <valuePrefix>Location="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>Location</fieldForLabel>
      <fieldForValue>Location</fieldForValue>
    </input>
    <input type="multiselect" token="tok_OS" searchWhenChanged="true">
      <label>O.S</label>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Operating System" as OS "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by OS</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <default>All</default>
      <prefix>(</prefix>
      <valuePrefix>OS="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>O.S</fieldForLabel>
      <fieldForValue>OS</fieldForValue>
    </input>
    <input type="multiselect" token="tok_CompName" searchWhenChanged="true">
      <label>Component Name</label>
      <!-- <default>All</default> -->
      <prefix>(</prefix>
      <valuePrefix>ComponentName="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>OR</delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>Component Name</fieldForLabel>
      <fieldForValue>ComponentName</fieldForValue>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Component Name" as ComponentName "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by ComponentName</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <!--  <choice value="*">All</choice>
      <suffix>)</suffix>  -->
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Server Count $tok_count$</title>
      <html>
        <style>
       .dashboard-row .dashboard-panel h2.panel-title {
             background:PALEGOLDENROD  !important;
             color:black !important;
             font-size: 16px !important;
             font-family:Helvetica, sans-serif !important;
             text-align: center !important;
             font-weight: bold !important;
           }

        </style>
        <div/>
      </html>
      <table>
        <search>
          <progress>
            <set token="tok_count">$job.resultCount$</set>
          </progress>
          <query>  | inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv   | rename "Deployment Name" as deploymentName "FQM" as ServerName "Server Name" as ServerName "Server Nature" as ServerNature   "Operating System" as OS "Application Name" as ApplicationName  "Component Name" as ComponentName  | lookup XYZ_Server_Status.csv Server_Name as ServerName OUTPUT Status  | fillnull ApplicationName ComponentName Location ServerName ServerNature OS deploymentName Status value=NULL   | search  $tok_DeploymentName$ $tok_ServerName$ $tok_ServerNature$   $tok_Location$ $tok_OS$ $tok_ApplicationName$ $tok_CompName$ $tok_ServerStatus$ | stats values(Status) as "Server Status" values(ApplicationName) as "Application Name",  values(ServerNature) as "Server Nature", values(deploymentName) as "Deployment Name", values(Location) as Location, values(ComponentName) as "Component Name" values(OS) as "O.S" by ServerName | sort  ServerName   </query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

gcusello · ‎11-08-2020

Hi @Mary666,

another thing, the search in the multiselect it's strange: you can use | inputlookup only at the beginning of a search (or a sub search), you cannot use more inputlookups one after one.

Wjhat do you want to list in that search?

Ciao.

Giuseppe

Multiselect Tokens not passing values

other

Extending Observability Content to Splunk Cloud

More Control Over Your Monitoring Costs with Archived Metrics!

New in Observability Cloud - Explicit Bucket Histograms