Passing token from a multiselect to populate a dropdown

[irvindominguezs]

<fieldset submitButton="true">
<input type="multiselect" token="multiselect_token" searchWhenChanged="false">
<label>Proxy</label>
<fieldForLabel>Proxy</fieldForLabel>
<fieldForValue>headers.apiproxy</fieldForValue>
<search>
<query>index=apigee sourcetype=apigee_metrics | dedup headers.apiproxy | table headers.apiproxy</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<valuePrefix>headers.apiproxy="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
</input>
<input type="time" token="field2" searchWhenChanged="false">
<label>Time</label>
<default>
<earliest>-5m</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="field3" searchWhenChanged="false">
<label>Operation Path</label>
<fieldForLabel>OperationPath</fieldForLabel>
<fieldForValue>OperationPath</fieldForValue>
<search>
<query>index=apigee sourcetype=apigee_metrics $multiselect_token$ | stats count by apiStats.operation_path | dedup apiStats.operation_path | table apiStats.operation_path</query>
<earliest>$field2.earliest$</earliest>
<latest>$field2.latest$</latest>
</search>
</input>
</fieldset>

[niketn]

@irvindominguezs for the community to assist you better please provide relevant details as well. With your current code what is the issue you are facing?

For the dropdown search SPL, what is the exact filter that should be passed as token? Add some sample data and example of the use by anonymizing any sensitive information.

As per the code, if Multiselect has 3 proxy values selected proxy1, proxy2 and proxy3, then the dropdown SPL will have value like the following in the SPL headers.apiproxy="proxy1" OR headers.apiproxy="proxy2" OR headers.apiproxy="proxy3". What is the expected value, if not this?

index=apigee sourcetype=apigee_metrics headers.apiproxy="proxy1" OR headers.apiproxy="proxy2" OR headers.apiproxy="proxy3"