Dashboards & Visualizations

Multiselect not popping on another multiple after selecting on first one

DougiieDee
Explorer

I have created a multiselect dashboard which has a City and Address. If I select ABCadd from City i can see multiple addresses in Address, but when i add another BBCadd from City which now have two selection in 1st multiselect, i can only see 1st selected City addresses but when I select ALL and search i can see both two address. I want to have both selection shown in second multiselect where i can select only wanted address. I am using csv file and inputlookup for multiselect. here is my xml.


 <input type="multiselect" token="City " searchWhenChanged="true">
<label>City </label>
<fieldForLabel>City </fieldForLabel>
<fieldForValue>City </fieldForValue>
<search>
<query>|inputlookup aaa.csv | dedup City | table City </query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<choice value="*">All</choice>
</input>
<input type="multiselect" token="ShopName" searchWhenChanged="true">
<label>Shop Name</label>
<choice value="*">ALL</choice>
<fieldForLabel>ShopName</fieldForLabel>
<fieldForValue>ShopName</fieldForValue>
<search>
<query>|inputlookup aaa.csv | search City =$City$| dedup ShopName| table ShopName</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
</input>

<search>
<query>index=*  City =$City $ ShopName=$ShopName$
|stats values(ShopName) as ShopName, count by Address</query>
<earliest>$Timer.earliest$</earliest>
<latest>$Timer.latest$</latest>
</search>

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@DougiieDee 

Can you please check this SAMPLE example for clue?

<form>
  <search id="lookup_search">
    <query>| makeresults | eval _raw="City,Shop,Address
A,A1,A123
A,A2,A234
A,A3,A345
A,A4,A456
B,B1,B123
B,B2,B234
B,B3,B345
B,B4,B456
C,C1,C123
C,C2,C234
C,C3,C345
C,C4,C456
D,D1,D123
D,D2,D234
D,D3,D345
D,D4,D456"| multikv forceheader=1 | table City Shop Address</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </search>
  <label>Multiselect_DD</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="tkn_city">
      <label>City</label>
      <fieldForLabel>City</fieldForLabel>
      <fieldForValue>City</fieldForValue>
      <search base="lookup_search">
        <query>| dedup City | table City</query>
      </search>
      <prefix>City IN (</prefix>
      <suffix>)</suffix>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> ,</delimiter>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
    <input type="multiselect" token="tkn_shop">
      <label>Shop</label>
      <fieldForLabel>Shop</fieldForLabel>
      <fieldForValue>Shop</fieldForValue>
      <search base="lookup_search">
        <query>| search $tkn_city$ | dedup Shop | table Shop</query>
      </search>
      <prefix>Shop IN (</prefix>
      <suffix>)</suffix>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> ,</delimiter>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $tkn_city$ <br/>
        $tkn_shop$
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search base="lookup_search">
          <query>search $tkn_city$ AND $tkn_shop$</query>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

 

Thanks
KV
▄︻̷̿┻̿═━一   

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

DougiieDee
Explorer
it didnt wokt
0 Karma

venkatasri
SplunkTrust
SplunkTrust

@DougiieDee 

Can you try this? Just change the value_prefix from source= to your required one.

 

<prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>source="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>

 

 

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...