Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Multiselect not popping on another multiple after...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Multiselect not popping on another multiple after selecting on first one
I have created a multiselect dashboard which has a City and Address. If I select ABCadd from City i can see multiple addresses in Address, but when i add another BBCadd from City which now have two selection in 1st multiselect, i can only see 1st selected City addresses but when I select ALL and search i can see both two address. I want to have both selection shown in second multiselect where i can select only wanted address. I am using csv file and inputlookup for multiselect. here is my xml.
<input type="multiselect" token="City " searchWhenChanged="true">
<label>City </label>
<fieldForLabel>City </fieldForLabel>
<fieldForValue>City </fieldForValue>
<search>
<query>|inputlookup aaa.csv | dedup City | table City </query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<choice value="*">All</choice>
</input>
<input type="multiselect" token="ShopName" searchWhenChanged="true">
<label>Shop Name</label>
<choice value="*">ALL</choice>
<fieldForLabel>ShopName</fieldForLabel>
<fieldForValue>ShopName</fieldForValue>
<search>
<query>|inputlookup aaa.csv | search City =$City$| dedup ShopName| table ShopName</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
</input>
<search>
<query>index=* City =$City $ ShopName=$ShopName$
|stats values(ShopName) as ShopName, count by Address</query>
<earliest>$Timer.earliest$</earliest>
<latest>$Timer.latest$</latest>
</search>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you please check this SAMPLE example for clue?
<form>
<search id="lookup_search">
<query>| makeresults | eval _raw="City,Shop,Address
A,A1,A123
A,A2,A234
A,A3,A345
A,A4,A456
B,B1,B123
B,B2,B234
B,B3,B345
B,B4,B456
C,C1,C123
C,C2,C234
C,C3,C345
C,C4,C456
D,D1,D123
D,D2,D234
D,D3,D345
D,D4,D456"| multikv forceheader=1 | table City Shop Address</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<label>Multiselect_DD</label>
<fieldset submitButton="false">
<input type="multiselect" token="tkn_city">
<label>City</label>
<fieldForLabel>City</fieldForLabel>
<fieldForValue>City</fieldForValue>
<search base="lookup_search">
<query>| dedup City | table City</query>
</search>
<prefix>City IN (</prefix>
<suffix>)</suffix>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> ,</delimiter>
<choice value="*">All</choice>
<default>*</default>
</input>
<input type="multiselect" token="tkn_shop">
<label>Shop</label>
<fieldForLabel>Shop</fieldForLabel>
<fieldForValue>Shop</fieldForValue>
<search base="lookup_search">
<query>| search $tkn_city$ | dedup Shop | table Shop</query>
</search>
<prefix>Shop IN (</prefix>
<suffix>)</suffix>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> ,</delimiter>
<choice value="*">All</choice>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<html>
$tkn_city$ <br/>
$tkn_shop$
</html>
</panel>
</row>
<row>
<panel>
<table>
<search base="lookup_search">
<query>search $tkn_city$ AND $tkn_shop$</query>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you try this? Just change the value_prefix from source= to your required one.
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>source="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud
Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know
October Community Champions: A Shoutout to Our Contributors!
