Dashboards & Visualizations

Multiselect Tstats Tokens

robertlynch2020
Motivator

Hi

I am trying to apply a Multiselect into a token.
For example, I can change the value of MXTIMING.NPID to the PID 123 and it works - so that is one value.
What I want to do is activate a Multiselect on this token so I can select 123 and 345 and 345, etc. ...

I have tried to add in a prefix of OR but it's not working.

INITIAL - Query

    <query>| tstats summariesonly=$summariesonly_token$ avg(MXTIMING.Elapsed) AS average FROM datamodel=MXTIMING_TEST WHERE 
               host=$host_token$ 
    AND MXTIMING.source_path = *$source_path_search_token$ 
    AND MXTIMING.UserName2=$MXTIMING_UserName_token$ 
    AND MXTIMING.NPID=*$MXTIMING_NPID_token$*  
    AND MXTIMING.MXTIMING_TYPE_DM=$MXTIMING_TYPE_TOKEN$ 
    AND MXTIMING.Context+Command = *$MXTIMING_Context_token$#*
    AND MXTIMING.Context+Command = *#$MXTIMING_Command_token$*
    AND MXTIMING.Time = *
    GROUPBY MXTIMING.Context+Command MXTIMING.NPID MXTIMING.Time 

I tried to add in a way to use OR, but i cant seem to find a way - to me this would be the best way

  <query>| tstats summariesonly=$summariesonly_token$ avg(MXTIMING.Elapsed) AS average FROM datamodel=MXTIMING_TEST WHERE 
                   host=$host_token$ 
        AND MXTIMING.source_path = *$source_path_search_token$ 
        AND MXTIMING.UserName2=$MXTIMING_UserName_token$ 
        AND MXTIMING.NPID="1123" OR "11232"  
        AND MXTIMING.MXTIMING_TYPE_DM=$MXTIMING_TYPE_TOKEN$ 
        AND MXTIMING.Context+Command = *$MXTIMING_Context_token$#*
        AND MXTIMING.Context+Command = *#$MXTIMING_Command_token$*
        AND MXTIMING.Time = *
        GROUPBY MXTIMING.Context+Command MXTIMING.NPID MXTIMING.Time 

In the end i have to change the TOKEN to equal the full string repeating it self [], however this is long and if i want to use this token again i will have to strip out the token value prefix = MXTIMING.NPID

    <query>| tstats summariesonly=$summariesonly_token$ avg(MXTIMING.Elapsed) AS average FROM datamodel=MXTIMING_TEST WHERE 
               host=$host_token$ 
    AND MXTIMING.source_path = *$source_path_search_token$ 
    AND MXTIMING.UserName2=$MXTIMING_UserName_token$ 
  MXTIMING.NPID=10025 OR MXTIMING.NPID=10784 OR MXTIMING.NPID=11858 OR MXTIMING.NPID=12170  
    AND MXTIMING.MXTIMING_TYPE_DM=$MXTIMING_TYPE_TOKEN$ 
    AND MXTIMING.Context+Command = *$MXTIMING_Context_token$#*
    AND MXTIMING.Context+Command = *#$MXTIMING_Command_token$*
    AND MXTIMING.Time = *
    GROUPBY MXTIMING.Context+Command MXTIMING.NPID MXTIMING.Time 
0 Karma
1 Solution

robertlynch2020
Motivator

Hi

I fond an answer to this

MXTIMING.NPID IN (10025 10948 11858)

boom 🙂

View solution in original post

0 Karma

robertlynch2020
Motivator

Hi

I fond an answer to this

MXTIMING.NPID IN (10025 10948 11858)

boom 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...