Not all the values are populating from the drop-down to the dashboards with variable

[aditsss]

Hi Everyone,

I have one requirement. 

Below is my drop-down code from which I am populating the OrgName :

<label> Licenses Clone06</label>
<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="OrgName" searchWhenChanged="true">
<label>Org Name</label>
<choice value="*">All Salesforce Org</choice>
<search>
<query>index="ABC" sourcetype="XYZ" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | stats count by OrgName</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>OrgName</fieldForValue>
<delimiter> OR </delimiter>
<initialValue>*</initialValue>
<default>*</default>
</input>

The issue now I am facing is its not working when I am selecting multiple orgs from drop-down.

Sometimes its displaying only the 1st value from the drop-down in dashboard or if I select 6 values its only displaying the data of 4 .

Below is the code for the query:

<query>index="ABC" sourcetype="XYZ" $type$ |lookup Org_Alias.csv OrgFolderName OUTPUT OrgName| search OrgName=$OrgName$|dedup OrgName, LicenseName, OrgId |stats sum(TotalLicenses) as "Total-Licenses" sum(UsedLicenses) as "Used Licenses" sum(UnusedLicenses) as "Unused Licenses" by LicenseName OrgName OrgId | sort -Total-Licenses</query>

Can someone guide me what is wrong in the query.

[t_shreya]

Hi @aditsss 

I think that your current query would result into something like this:
OrgName="value1" OR "value2" OR "value3"..

You can try the following to see if it works.

Provide value prefix as OrgName= in the multiselect filter which would set the token as (OrgName=value1 OR OrgName=value2 OR..). This means the code would be something like this:

<label> Licenses Clone06</label>
<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="OrgName" searchWhenChanged="true">
<label>Org Name</label>
<choice value="*">All Salesforce Org</choice>
<search>
<query>index="ABC" sourcetype="XYZ" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | stats count by OrgName</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<fieldForLabel>OrgName</fieldForLabel>
<fieldForValue>OrgName</fieldForValue>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>source="</valuePrefix>
<delimiter> OR </delimiter>
<initialValue>*</initialValue>
<default>*</default>
</input>

And the subsequent change the query would be to just have the token name:

index="ABC" sourcetype="XYZ" $type$ |lookup Org_Alias.csv OrgFolderName OUTPUT OrgName| search $OrgName$|dedup OrgName, LicenseName, OrgId |stats sum(TotalLicenses) as "Total-Licenses" sum(UsedLicenses) as "Used Licenses" sum(UnusedLicenses) as "Unused Licenses" by LicenseName OrgName OrgId | sort -Total-Licenses

[ITWhisperer]

I suspect $OrgName$ does not contain what you expect for it to be able to sit in your query the way it is. Have you tried displaying $OrgName$ somewhere on your dashboard temporarily so you can see what it is?