Dashboards & Visualizations

Multiselect Tokens not passing values

Mary666
Communicator

Hello All,

I need to have the multiselect  for Application Name apply its value to the Server Status Multiselect. I have a token for Application Name and have been able to pass it to the other multiselects, but I cant seem to pass it for the Server Status. Any advise would greatly help. 

 

<form theme="light">
   <label>Sample Dashboard</label>
   <fieldset submitButton="false">
      <input type="multiselect" token="tok_ApplicationName" searchWhenChanged="true">
         <label>Application Name</label>
         <choice value="*">All</choice>
         <fieldForLabel>Application Name</fieldForLabel>
         <fieldForValue>ApplicationName</fieldForValue>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Application Name" as ApplicationName | stats count by ApplicationName</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <delimiter>OR</delimiter>
         <default>*</default>
         <prefix>(</prefix>
         <suffix>)</suffix>
         <valuePrefix>ApplicationName="</valuePrefix>
         <valueSuffix>"</valueSuffix>
      </input>
      <input type="multiselect" token="tok_ServerName" searchWhenChanged="true">
         <label>Server Name</label>
         <choice value="*">All</choice>
         <fieldForLabel>Server Name</fieldForLabel>
         <fieldForValue>ServerName</fieldForValue>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Domain Name" as ServerName "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by ServerName | table ServerName</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <delimiter>OR</delimiter>
         <default>*</default>
         <prefix>(</prefix>
         <suffix>)</suffix>
         <valuePrefix>ServerName="</valuePrefix>
         <valueSuffix>"</valueSuffix>
      </input>
      <input type="multiselect" token="tok_ServerStatus" searchWhenChanged="true">
         <label>Server Status</label>
         <choice value="*">All</choice>
         <fieldForLabel>Status</fieldForLabel>
         <fieldForValue>Status</fieldForValue>
         <search>
            <query>| inputlookup SPL_Server_Status.csv | rename "Application" as ApplicationName | search $tok_ApplicationName$ | stats count by Status | table Status</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <delimiter>OR</delimiter>
         <default>All</default>
         <prefix>(</prefix>
         <suffix>)</suffix>
         <valuePrefix>Status="</valuePrefix>
         <valueSuffix>"</valueSuffix>
      </input>
      <input type="multiselect" token="tok_ServerNature" searchWhenChanged="true">
         <label>Server Nature</label>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Server Nature" as ServerNature "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by ServerNature | table ServerNature</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <default>All</default>
         <prefix>(</prefix>
         <valuePrefix>ServerNature="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>Server Nature</fieldForLabel>
         <fieldForValue>ServerNature</fieldForValue>
      </input>
      <input type="multiselect" token="tok_DeploymentName" searchWhenChanged="true">
         <label>Deployment Name</label>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Deployment Name" as deploymentName "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by deploymentName | table deploymentName</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <default>All</default>
         <prefix>(</prefix>
         <valuePrefix>deploymentName="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>Deployment Name</fieldForLabel>
         <fieldForValue>deploymentName</fieldForValue>
      </input>
      <input type="multiselect" token="tok_Location" searchWhenChanged="true">
         <label>Location</label>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by Location | table Location</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <default>All</default>
         <prefix>(</prefix>
         <valuePrefix>Location="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>Location</fieldForLabel>
         <fieldForValue>Location</fieldForValue>
      </input>
      <input type="multiselect" token="tok_OS" searchWhenChanged="true">
         <label>O.S</label>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Operating System" as OS "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by OS</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <default>All</default>
         <prefix>(</prefix>
         <valuePrefix>OS="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>O.S</fieldForLabel>
         <fieldForValue>OS</fieldForValue>
      </input>
      <input type="multiselect" token="tok_CompName" searchWhenChanged="true">
         <label>Component Name</label>
         <!-- <default>All</default> -->
         <prefix>(</prefix>
         <valuePrefix>ComponentName="</valuePrefix>
         <valueSuffix>"</valueSuffix>
         <delimiter>OR</delimiter>
         <suffix>)</suffix>
         <choice value="*">All</choice>
         <fieldForLabel>Component Name</fieldForLabel>
         <fieldForValue>ComponentName</fieldForValue>
         <search>
            <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Component Name" as ComponentName "Application Name" as ApplicationName | search $tok_ApplicationName$ | stats count by ComponentName</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
         </search>
         <!-- <choice value="*">All</choice>
<suffix>)</suffix> -->
         <default>*</default>
      </input>
   </fieldset>
   <row>
      <panel>
         <title>Server Count $tok_count$</title>
         <html>
            <style>.dashboard-row .dashboard-panel h2.panel-title {
background:PALEGOLDENROD !important;
color:black !important;
font-size: 16px !important;
font-family:Helvetica, sans-serif !important;
text-align: center !important;
font-weight: bold !important;
}</style>
            <div />
         </html>
         <table>
            <search>
               <progress>
                  <set token="tok_count">$job.resultCount$</set>
               </progress>
               <query>| inputlookup X_Servers_Report.csv | inputlookup append=t Y_Servers_Report.csv | inputlookup append=t B_Servers_Report.csv | inputlookup append=t J_Servers_Report.csv | inputlookup append=t R_Servers_Report.csv | rename "Deployment Name" as deploymentName "Server Name" as ServerName "Server Nature" as ServerNature "Operating System" as OS "Application Name" as ApplicationName "Component Name" as ComponentName | lookup SPL_Server_Status.csv Server_Name as ServerName OUTPUT Status | fillnull ApplicationName ComponentName Location ServerName ServerNature OS deploymentName Status value=NULL | search $tok_DeploymentName$ $tok_ServerName$ $tok_ServerNature$ $tok_Location$ $tok_OS$ $tok_ApplicationName$ $tok_CompName$ $tok_ServerStatus$ | stats values(Status) as "Server Status" values(ApplicationName) as "Application Name", values(ServerNature) as "Server Nature", values(deploymentName) as "Deployment Name", values(Location) as Location, values(ComponentName) as "Component Name" values(OS) as "O.S" by ServerName | sort ServerName</query>
               <earliest>-15m</earliest>
               <latest>now</latest>
            </search>
            <option name="drilldown">none</option>
         </table>
      </panel>
   </row>
</form>

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mary666,

the only thing I see is the delimiter, try to add a space before and after OR:

<delimiter> OR </delimiter>

Ciao.

Giuseppe

0 Karma

renjith_nair
Legend

Please use code sample (</>) to post your code for better readability. I have formatted and updated it for now.

Could you please explain what exactly the problem is? Are you getting any error or the values are not detected correctly ?

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

Mary666
Communicator

Hello,

I have made some edits to my code and have fixed a few issues along the way. However, I am still not able to pass the Application Name token over to the Server Status input box. I would appriciate any leads.

 

 

 

<form theme="light">
  <label>Example Dashboard</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="tok_ApplicationName" searchWhenChanged="true">
      <label>Application Name</label>
      <choice value="*">All</choice>
      <fieldForLabel>Application Name</fieldForLabel>
      <fieldForValue>ApplicationName</fieldForValue>
      <search>
        <query>  | inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ]  | rename "Application Name"  as ApplicationName  | stats count by ApplicationName   </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <delimiter>OR </delimiter>
      <default>*</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>ApplicationName="</valuePrefix>
      <valueSuffix>"</valueSuffix>
    </input>
    <input type="multiselect" token="tok_ServerName" searchWhenChanged="true">
      <label>Server Name</label>
      <choice value="*">All</choice>
      <fieldForLabel>Server Name</fieldForLabel>
      <fieldForValue>ServerName</fieldForValue>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "FQM" as ServerName "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by ServerName  | table ServerName  </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <delimiter>OR </delimiter>
      <default>*</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>ServerName="</valuePrefix>
      <valueSuffix>"</valueSuffix>
    </input>
    <input type="multiselect" token="tok_ServerStatus" searchWhenChanged="true">
      <label>Server Status</label>
      <choice value="*">All</choice>
      <fieldForLabel>Server Status</fieldForLabel>
      <fieldForValue>Status</fieldForValue>
      <search>
        <query>  | inputlookup XYZ_Server_Status.csv  | inputlookup append=t ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv   | rename  "Application" as ApplicationName  "Server_Name" as ServerName | search $tok_ApplicationName$  | stats count by Status   | table Status  </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <delimiter> OR </delimiter>
      <default>All</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>Status="</valuePrefix>
      <valueSuffix>"</valueSuffix>
    </input>
    <input type="multiselect" token="tok_ServerNature" searchWhenChanged="true">
      <label>Server Nature</label>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Server Nature" as ServerNature "Application Name"  as ApplicationName | search $tok_ApplicationName$ | stats count by ServerNature   | table ServerNature   </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <default>All</default>
      <prefix>(</prefix>
      <valuePrefix>ServerNature="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>Server Nature</fieldForLabel>
      <fieldForValue>ServerNature</fieldForValue>
    </input>
    <input type="multiselect" token="tok_DeploymentName" searchWhenChanged="true">
      <label>Deployment Name</label>
      <search>
        <query> | inputlookup ABC_Toys_Report.csv  | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Deployment Name" as deploymentName "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by deploymentName  | table deploymentName   </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <default>All</default>
      <prefix>(</prefix>
      <valuePrefix>deploymentName="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>Deployment Name</fieldForLabel>
      <fieldForValue>deploymentName</fieldForValue>
    </input>
    <input type="multiselect" token="tok_Location" searchWhenChanged="true">
      <label>Location</label>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by Location  | table Location  </query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <default>All</default>
      <prefix>(</prefix>
      <valuePrefix>Location="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>Location</fieldForLabel>
      <fieldForValue>Location</fieldForValue>
    </input>
    <input type="multiselect" token="tok_OS" searchWhenChanged="true">
      <label>O.S</label>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Operating System" as OS "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by OS</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <default>All</default>
      <prefix>(</prefix>
      <valuePrefix>OS="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>O.S</fieldForLabel>
      <fieldForValue>OS</fieldForValue>
    </input>
    <input type="multiselect" token="tok_CompName" searchWhenChanged="true">
      <label>Component Name</label>
      <!-- <default>All</default> -->
      <prefix>(</prefix>
      <valuePrefix>ComponentName="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>OR</delimiter>
      <suffix>)</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>Component Name</fieldForLabel>
      <fieldForValue>ComponentName</fieldForValue>
      <search>
        <query>| inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv | append [ search  inputlookup XYZ_Server_Status.csv ] | rename "Component Name" as ComponentName "Application Name"  as ApplicationName | search $tok_ApplicationName$  | stats count by ComponentName</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <!--  <choice value="*">All</choice>
      <suffix>)</suffix>  -->
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Server Count $tok_count$</title>
      <html>
        <style>
       .dashboard-row .dashboard-panel h2.panel-title {
             background:PALEGOLDENROD  !important;
             color:black !important;
             font-size: 16px !important;
             font-family:Helvetica, sans-serif !important;
             text-align: center !important;
             font-weight: bold !important;
           }

        </style>
        <div/>
      </html>
      <table>
        <search>
          <progress>
            <set token="tok_count">$job.resultCount$</set>
          </progress>
          <query>  | inputlookup ABC_Toys_Report.csv | inputlookup append=t DEF_Toys_Report.csv | inputlookup append=t GHI_Toys_Report.csv | inputlookup append=t JKL_Toys_Report.csv | inputlookup append=t MNO_Toys_Report.csv   | rename "Deployment Name" as deploymentName "FQM" as ServerName "Server Name" as ServerName "Server Nature" as ServerNature   "Operating System" as OS "Application Name" as ApplicationName  "Component Name" as ComponentName  | lookup XYZ_Server_Status.csv Server_Name as ServerName OUTPUT Status  | fillnull ApplicationName ComponentName Location ServerName ServerNature OS deploymentName Status value=NULL   | search  $tok_DeploymentName$ $tok_ServerName$ $tok_ServerNature$   $tok_Location$ $tok_OS$ $tok_ApplicationName$ $tok_CompName$ $tok_ServerStatus$ | stats values(Status) as "Server Status" values(ApplicationName) as "Application Name",  values(ServerNature) as "Server Nature", values(deploymentName) as "Deployment Name", values(Location) as Location, values(ComponentName) as "Component Name" values(OS) as "O.S" by ServerName | sort  ServerName   </query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mary666,

another thing, the search in the multiselect it's strange: you can use | inputlookup only at the beginning of a search (or a sub search), you cannot use more inputlookups one after one.

Wjhat do you want to list in that search?

Ciao.

Giuseppe

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...