Re: Multiselect not popping on another multiple a...

DougiieDee · ‎07-24-2021

I have created a multiselect dashboard which has a City and Address. If I select ABCadd from City i can see multiple addresses in Address, but when i add another BBCadd from City which now have two selection in 1st multiselect, i can only see 1st selected City addresses but when I select ALL and search i can see both two address. I want to have both selection shown in second multiselect where i can select only wanted address. I am using csv file and inputlookup for multiselect. here is my xml.

<input type="multiselect" token="City " searchWhenChanged="true">
<label>City </label>
<fieldForLabel>City </fieldForLabel>
<fieldForValue>City </fieldForValue>
<search>
<query>|inputlookup aaa.csv | dedup City | table City </query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<choice value="*">All</choice>
</input>
<input type="multiselect" token="ShopName" searchWhenChanged="true">
<label>Shop Name</label>
<choice value="*">ALL</choice>
<fieldForLabel>ShopName</fieldForLabel>
<fieldForValue>ShopName</fieldForValue>
<search>
<query>|inputlookup aaa.csv | search City =$City$| dedup ShopName| table ShopName</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
</input>

<search>
<query>index=* City =$City $ ShopName=$ShopName$
|stats values(ShopName) as ShopName, count by Address</query>
<earliest>$Timer.earliest$</earliest>
<latest>$Timer.latest$</latest>
</search>

kamlesh_vaghela · ‎07-25-2021

@DougiieDee

Can you please check this SAMPLE example for clue?

<form>
  <search id="lookup_search">
    <query>| makeresults | eval _raw="City,Shop,Address
A,A1,A123
A,A2,A234
A,A3,A345
A,A4,A456
B,B1,B123
B,B2,B234
B,B3,B345
B,B4,B456
C,C1,C123
C,C2,C234
C,C3,C345
C,C4,C456
D,D1,D123
D,D2,D234
D,D3,D345
D,D4,D456"| multikv forceheader=1 | table City Shop Address</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </search>
  <label>Multiselect_DD</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="tkn_city">
      <label>City</label>
      <fieldForLabel>City</fieldForLabel>
      <fieldForValue>City</fieldForValue>
      <search base="lookup_search">
        <query>| dedup City | table City</query>
      </search>
      <prefix>City IN (</prefix>
      <suffix>)</suffix>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> ,</delimiter>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
    <input type="multiselect" token="tkn_shop">
      <label>Shop</label>
      <fieldForLabel>Shop</fieldForLabel>
      <fieldForValue>Shop</fieldForValue>
      <search base="lookup_search">
        <query>| search $tkn_city$ | dedup Shop | table Shop</query>
      </search>
      <prefix>Shop IN (</prefix>
      <suffix>)</suffix>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> ,</delimiter>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $tkn_city$ <br/>
        $tkn_shop$
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search base="lookup_search">
          <query>search $tkn_city$ AND $tkn_shop$</query>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

DougiieDee · ‎07-29-2021

it didnt wokt

venkatasri · ‎07-29-2021

@DougiieDee

Can you try this? Just change the value_prefix from source= to your required one.

<prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>source="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>

Multiselect not popping on another multiple after selecting on first one

panel

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

Index This | What are the 12 Days of Splunk-mas?