Dashboards & Visualizations

Multiselect Tokens not passing values

Mary666
Communicator

Hello All,

I need to have the multiselect  for Application Name apply its value to the Server Status Multiselect. I have a token for Application Name and have been able to pass it to the other multiselects, but I cant seem to pass it for the Server Status. Any advise would greatly help. 

 

<form theme="light">
   <label>Sample Dashboard</label>
   <fieldset submitButton="false">
      <input type="multiselect" token="tok_ApplicationName" searchWhenChanged="true">
         <label>Application Name</label>
         <choice value="*">All</choice>
         <fieldForLabel>Application Name</fieldForLabel>
         <fieldForValue>ApplicationName</fieldForValue>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Application Name" as ApplicationName | stats count by ApplicationName</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <delimiter>OR</delimiter>
         <default>*</default>
         <prefix>(</prefix>
         <suffix>)</suffix>
         <valuePrefix>ApplicationName="</valuePrefix>
         <valueSuffix>"</valueSuffix>
      </input>
      <input type="multiselect" token="tok_ServerName" searchWhenChanged="true">
         <label>Server Name</label>
         <choice value="*">All</choice>
         <fieldForLabel>Server Name</fieldForLabel>
         <fieldForValue>ServerName</fieldForValue>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Domain Name" as ServerName "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by ServerName | table ServerName</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <delimiter>OR</delimiter>
         <default>*</default>
         <prefix>(</prefix>
         <suffix>)</suffix>
         <valuePrefix>ServerName="</valuePrefix>
         <valueSuffix>"</valueSuffix>
      </input>
      <input type="multiselect" token="tok_ServerStatus" searchWhenChanged="true">
         <label>Server Status</label>
         <choice value="*">All</choice>
         <fieldForLabel>Status</fieldForLabel>
         <fieldForValue>Status</fieldForValue>
         <search>
            <query>| inputlookup SPL_Server_Status.csv | rename "Application" as ApplicationName | search $tok_ApplicationName$ | stats count by Status | table Status</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <delimiter>OR</delimiter>
         <default>All</default>
         <prefix>(</prefix>
         <suffix>)</suffix>
         <valuePrefix>Status="</valuePrefix>
         <valueSuffix>"</valueSuffix>
      </input>
      <input type="multiselect" token="tok_ServerNature" searchWhenChanged="true">
         <label>Server Nature</label>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Server Nature" as ServerNature "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by ServerNature | table ServerNature</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <default>All</default>
         <prefix>(</prefix>
         <valuePrefix>ServerNature="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>Server Nature</fieldForLabel>
         <fieldForValue>ServerNature</fieldForValue>
      </input>
      <input type="multiselect" token="tok_DeploymentName" searchWhenChanged="true">
         <label>Deployment Name</label>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Deployment Name" as deploymentName "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by deploymentName | table deploymentName</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <default>All</default>
         <prefix>(</prefix>
         <valuePrefix>deploymentName="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>Deployment Name</fieldForLabel>
         <fieldForValue>deploymentName</fieldForValue>
      </input>
      <input type="multiselect" token="tok_Location" searchWhenChanged="true">
         <label>Location</label>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by Location | table Location</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <default>All</default>
         <prefix>(</prefix>
         <valuePrefix>Location="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>Location</fieldForLabel>
         <fieldForValue>Location</fieldForValue>
      </input>
      <input type="multiselect" token="tok_OS" searchWhenChanged="true">
         <label>O.S</label>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Operating System" as OS "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by OS</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <default>All</default>
         <prefix>(</prefix>
         <valuePrefix>OS="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>O.S</fieldForLabel>
         <fieldForValue>OS</fieldForValue>
      </input>
      <input type="multiselect" token="tok_CompName" searchWhenChanged="true">
         <label>Component Name</label>
         <!-- <default>All</default> -->
         <prefix>(</prefix>
         <valuePrefix>ComponentName="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>Component Name</fieldForLabel>
         <fieldForValue>ComponentName</fieldForValue>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Component Name" as ComponentName "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by ComponentName</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <!-- <choice value="*">All</choice>
<suffix>)</suffix> -->
         <default>*</default>
      </input>
   </fieldset>
   <row>
      <panel>
         <title>Server Count $tok_count$</title>
         <html>
            <style>.dashboard-row .dashboard-panel h2.panel-title {
background:PALEGOLDENROD !important;
color:black !important;
font-size: 16px !important;
font-family:Helvetica, sans-serif !important;
text-align: center !important;
font-weight: bold !important;
}</style>
            <div />
         </html>
         <table>
            <search>
               <progress>
                  <set token="tok_count">$job.resultCount$</set>
               </progress>
               <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Deployment Name" as deploymentName "Server Name" as ServerName "Server Nature" as ServerNature "Operating System" as OS "Application Name" as ApplicationName "Component Name" as ComponentName | lookup SPL_Server_Status.csv Server_Name as ServerName OUTPUT Status | fillnull ApplicationName ComponentName Location ServerName ServerNature OS deploymentName Status value=NULL | search $tok_DeploymentName$ $tok_ServerName$ $tok_ServerNature$ $tok_Location$ $tok_OS$ $tok_ApplicationName$ $tok_CompName$ $tok_ServerStatus$ | stats values(Status) as "Server Status" values(ApplicationName) as "Application Name", values(ServerNature) as "Server Nature", values(deploymentName) as "Deployment Name", values(Location) as Location, values(ComponentName) as "Component Name" values(OS) as "O.S" by ServerName | sort ServerName</query>
               <earliest>-15m</earliest>
               <latest>now</latest>
            </search>
            <option name="drilldown">none</option>
         </table>
      </panel>
   </row>
</form>

 

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mary666,

the only thing I see is the delimiter, try to add a space before and after OR:

<delimiter> OR </delimiter>

Ciao.

Giuseppe

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Please use code sample (</>) to post your code for better readability. I have formatted and updated it for now.

Could you please explain what exactly the problem is? Are you getting any error or the values are not detected correctly ?

0 Karma

Mary666
Communicator

Hello,

I have made some edits to my code and have fixed a few issues along the way. However, I am still not able to pass the Application Name token over to the Server Status input box. I would appriciate any leads.

 

 

 

<form theme="light">
  <label>Example Dashboard</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="tok_ApplicationName" searchWhenChanged="true">
      <label>Application Name</label>
      <choice value="*">All</choice>
      <fieldForLabel>Application Name</fieldForLabel>
      <fieldForValue>ApplicationName</fieldForValue>
      <search>
        <query>  | inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ]  | rename "Application Name"  as ApplicationName  | stats count by ApplicationName   </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <delimiter>OR </delimiter>
      <default>*</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>ApplicationName="</valuePrefix>
      <valueSuffix>"</valueSuffix>
    </input>
    <input type="multiselect" token="tok_ServerName" searchWhenChanged="true">
      <label>Server Name</label>
      <choice value="*">All</choice>
      <fieldForLabel>Server Name</fieldForLabel>
      <fieldForValue>ServerName</fieldForValue>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "FQM" as ServerName "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by ServerName  | table ServerName  </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <delimiter>OR </delimiter>
      <default>*</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>ServerName="</valuePrefix>
      <valueSuffix>"</valueSuffix>
    </input>
    <input type="multiselect" token="tok_ServerStatus" searchWhenChanged="true">
      <label>Server Status</label>
      <choice value="*">All</choice>
      <fieldForLabel>Server Status</fieldForLabel>
      <fieldForValue>Status</fieldForValue>
      <search>
        <query>  | inputlookup XYZ_Server_Status.csv  | inputlookup append=t ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv   | rename  "Application" as ApplicationName  "Server_Name" as ServerName | search $tok_ApplicationName$  | stats count by Status   | table Status  </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <delimiter> OR </delimiter>
      <default>All</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>Status="</valuePrefix>
      <valueSuffix>"</valueSuffix>
    </input>
    <input type="multiselect" token="tok_ServerNature" searchWhenChanged="true">
      <label>Server Nature</label>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Server Nature" as ServerNature "Application Name"  as ApplicationName | search $tok_ApplicationName$ | stats count by ServerNature   | table ServerNature   </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <default>All</default>
      <prefix>(</prefix>
      <valuePrefix>ServerNature="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>Server Nature</fieldForLabel>
      <fieldForValue>ServerNature</fieldForValue>
    </input>
    <input type="multiselect" token="tok_DeploymentName" searchWhenChanged="true">
      <label>Deployment Name</label>
      <search>
        <query> | inputlookup ABC_Toys_Report.csv  | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Deployment Name" as deploymentName "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by deploymentName  | table deploymentName   </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <default>All</default>
      <prefix>(</prefix>
      <valuePrefix>deploymentName="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>Deployment Name</fieldForLabel>
      <fieldForValue>deploymentName</fieldForValue>
    </input>
    <input type="multiselect" token="tok_Location" searchWhenChanged="true">
      <label>Location</label>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by Location  | table Location  </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <default>All</default>
      <prefix>(</prefix>
      <valuePrefix>Location="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>Location</fieldForLabel>
      <fieldForValue>Location</fieldForValue>
    </input>
    <input type="multiselect" token="tok_OS" searchWhenChanged="true">
      <label>O.S</label>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Operating System" as OS "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by OS</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <default>All</default>
      <prefix>(</prefix>
      <valuePrefix>OS="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>O.S</fieldForLabel>
      <fieldForValue>OS</fieldForValue>
    </input>
    <input type="multiselect" token="tok_CompName" searchWhenChanged="true">
      <label>Component Name</label>
      <!-- <default>All</default> -->
      <prefix>(</prefix>
      <valuePrefix>ComponentName="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>OR</delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>Component Name</fieldForLabel>
      <fieldForValue>ComponentName</fieldForValue>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Component Name" as ComponentName "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by ComponentName</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <!--  <choice value="*">All</choice>
      <suffix>)</suffix>  -->
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Server Count $tok_count$</title>
      <html>
        <style>
       .dashboard-row .dashboard-panel h2.panel-title {
             background:PALEGOLDENROD  !important;
             color:black !important;
             font-size: 16px !important;
             font-family:Helvetica, sans-serif !important;
             text-align: center !important;
             font-weight: bold !important;
           }

        </style>
        <div/>
      </html>
      <table>
        <search>
          <progress>
            <set token="tok_count">$job.resultCount$</set>
          </progress>
          <query>  | inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv   | rename "Deployment Name" as deploymentName "FQM" as ServerName "Server Name" as ServerName "Server Nature" as ServerNature   "Operating System" as OS "Application Name" as ApplicationName  "Component Name" as ComponentName  | lookup XYZ_Server_Status.csv Server_Name as ServerName OUTPUT Status  | fillnull ApplicationName ComponentName Location ServerName ServerNature OS deploymentName Status value=NULL   | search  $tok_DeploymentName$ $tok_ServerName$ $tok_ServerNature$   $tok_Location$ $tok_OS$ $tok_ApplicationName$ $tok_CompName$ $tok_ServerStatus$ | stats values(Status) as "Server Status" values(ApplicationName) as "Application Name",  values(ServerNature) as "Server Nature", values(deploymentName) as "Deployment Name", values(Location) as Location, values(ComponentName) as "Component Name" values(OS) as "O.S" by ServerName | sort  ServerName   </query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mary666,

another thing, the search in the multiselect it's strange: you can use | inputlookup only at the beginning of a search (or a sub search), you cannot use more inputlookups one after one.

Wjhat do you want to list in that search?

Ciao.

Giuseppe

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!