Re: Multiselect not popping on another multiple a...

DougiieDee · ‎07-24-2021

I have created a multiselect dashboard which has a City and Address. If I select ABCadd from City i can see multiple addresses in Address, but when i add another BBCadd from City which now have two selection in 1st multiselect, i can only see 1st selected City addresses but when I select ALL and search i can see both two address. I want to have both selection shown in second multiselect where i can select only wanted address. I am using csv file and inputlookup for multiselect. here is my xml.

<input type="multiselect" token="City " searchWhenChanged="true">
<label>City </label>
<fieldForLabel>City </fieldForLabel>
<fieldForValue>City </fieldForValue>
<search>
<query>|inputlookup aaa.csv | dedup City | table City </query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<choice value="*">All</choice>
</input>
<input type="multiselect" token="ShopName" searchWhenChanged="true">
<label>Shop Name</label>
<choice value="*">ALL</choice>
<fieldForLabel>ShopName</fieldForLabel>
<fieldForValue>ShopName</fieldForValue>
<search>
<query>|inputlookup aaa.csv | search City =$City$| dedup ShopName| table ShopName</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
</input>

<search>
<query>index=* City =$City $ ShopName=$ShopName$
|stats values(ShopName) as ShopName, count by Address</query>
<earliest>$Timer.earliest$</earliest>
<latest>$Timer.latest$</latest>
</search>

kamlesh_vaghela · ‎07-25-2021

@DougiieDee

Can you please check this SAMPLE example for clue?

<form>
  <search id="lookup_search">
    <query>| makeresults | eval _raw="City,Shop,Address
A,A1,A123
A,A2,A234
A,A3,A345
A,A4,A456
B,B1,B123
B,B2,B234
B,B3,B345
B,B4,B456
C,C1,C123
C,C2,C234
C,C3,C345
C,C4,C456
D,D1,D123
D,D2,D234
D,D3,D345
D,D4,D456"| multikv forceheader=1 | table City Shop Address</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </search>
  <label>Multiselect_DD</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="tkn_city">
      <label>City</label>
      <fieldForLabel>City</fieldForLabel>
      <fieldForValue>City</fieldForValue>
      <search base="lookup_search">
        <query>| dedup City | table City</query>
      </search>
      <prefix>City IN (</prefix>
      <suffix>)</suffix>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> ,</delimiter>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
    <input type="multiselect" token="tkn_shop">
      <label>Shop</label>
      <fieldForLabel>Shop</fieldForLabel>
      <fieldForValue>Shop</fieldForValue>
      <search base="lookup_search">
        <query>| search $tkn_city$ | dedup Shop | table Shop</query>
      </search>
      <prefix>Shop IN (</prefix>
      <suffix>)</suffix>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> ,</delimiter>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $tkn_city$ <br/>
        $tkn_shop$
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search base="lookup_search">
          <query>search $tkn_city$ AND $tkn_shop$</query>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

DougiieDee · ‎07-29-2021

it didnt wokt

venkatasri · ‎07-29-2021

@DougiieDee

Can you try this? Just change the value_prefix from source= to your required one.

<prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>source="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>

Multiselect not popping on another multiple after selecting on first one

panel

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Observability Simplified: Combining User Experience, Application Performance & ...

Event Series May & June: From Network Visibility to Service Intelligence

Global Splunk User Group Events: May + June 2026

Join the Conversation