Dashboards & Visualizations

multi select box

vikas_gopal
Builder

Hi Guys,
I hope someone can help me .To prepare multiselect box I took help from Splunk 6 dashboard example and I used 2 script files on the basis of that data is appearing in the multiselect box but the problem is with table which is based on that selection for single value it works fine but when I select more than one value it says no record found.
What I have observed that the problem is with the join which has been mentioned in the javascript file (multi_value_token19.js) here is the overall code (xml code, test21.js , multi_value_token19.js)

**************XML code********************


<!-- Leverage row grouping to put the input in the panel -->

<!-- Use an html panel to have a place for multi_select.js to put the multi select -->





Multi Value Search
| dbquery "Finance Database" "select * from fa_deprn_periods where period_name like '$multiTokenQuery$' "




******************test21.js**********************

require(['jquery',
'underscore',
'splunkjs/mvc',
'splunkjs/mvc/multiselectview',
'splunkjs/mvc/searchmanager',
'splunkjs/mvc/simplexml/ready!'],
function($, _, mvc, MultiSelectView,SearchManager){

    //Instantiate our multi select view
    multiSelect = new MultiSelectView({
        "id": "multi_value_input",
        "value": "$submitted:multiToken$",
        "el": $('#multi_value_input'),
        "labelField": "period_name",
        "valueField": "period_name",
        "managerid": "multiSearch"
    }, {tokens: true}).render();

    //Run the search the multi select is looking for
    var multiSearch = new SearchManager({
        "id": "multiSearch",
        "earliest_time": "-15m",
        "status_buckets": 0,

"search": '| dbquery "Finance Database" "select period_name "period_name" from fa_deprn_periods"',
"cancelOnUnload": true,
"latest_time": "now",
"auto_cancel": 90,
"preview": true
}, {tokens: true});
}
);

***************multi_value_token19.js***************

require(['jquery','underscore','splunkjs/mvc','splunkjs/mvc/simplexml/ready!'], function($, _, mvc, SimpleSplunkView){

//Grab the instance of the token model for submitted tokens
var submitted = mvc.Components.get('submitted');

//When the token bound to the multi value input changes recompute the query
submitted.on('change:multiToken',function(submitted, value) {
    setMultiTokenQuery(value);
},this);


var setMultiTokenQuery = function(value){
    //Handle the default cases, if we aren't passed a value, search everything
    value = value || [];
    if (value.length === 0) {
        value.unshift("%");
    }

alert(value);
//Produce the search query and set the token
var multiTokenQuery = value.join('OR period_name=');
submitted.set('multiTokenQuery', multiTokenQuery);
};

//Set the initial value for the query.
setMultiTokenQuery(submitted.get('multiToken'));

});

Tags (1)
0 Karma
1 Solution

tfitzgerald_col
Engager

I'm running into this too. I think that " | dbquery " is non-functional in this search. As soon as I change it back to a search on indexed data, it works.

View solution in original post

0 Karma

tfitzgerald_col
Engager

I'm running into this too. I think that " | dbquery " is non-functional in this search. As soon as I change it back to a search on indexed data, it works.

0 Karma

vikas_gopal
Builder

@tfitzgerald_column
My mistake I should have answer this question as I resolved this issue .DBquery works absolutely fine actually problem was with the dashboard query which shows data in the table .Check the below link for the solution
http://answers.splunk.com/answers/123811/table-shows-no-record-if-multiple-values-selected-in-the-mu...

0 Karma
Get Updates on the Splunk Community!

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...