multiselect with AND

[sarit_s6]

Hello

is it possible to use multiselect input in classic dashboard so the selected objects there will be 
key=value AND key=value1 ? if im using IN its acts like OR

Thanks

[gcusello]

Hi @sarit_s6 ,

yes, you can use the IN operator and comma as separator.

Ciao.

Giuseppe

[VatsalJagani · Accepted solution]

Yes you can do that. @sarit_s6 

You can make use of 

<delimiter>	text		A string that will be placed between each selected value. Typically, you specify " OR " or " AND " using upper case – do not specify the quote marks, but specify a space character before and after the text.
<valuePrefix>	text		String prefixed to the value of the input element. Can be a regular expression.
<valueSuffix>	text		String appended to the value of the input element. Can be a regular expression.

delimiter -> AND

valuePrefix -> key="

valueSuffix -> "

This will prepare something like -> key="A" AND key="B" ....

I hope this helps!!!!

[sarit_s6]

thanks

its working

is it also possible to set it like that so when object is selected it will remove the "ALL" automatically ?

[VatsalJagani]

@sarit_s6 - That one requires Javascript to be written to remove "All" option.

Reference - https://community.splunk.com/t5/Dashboards-Visualizations/Remove-quot-All-quot-from-Multiselect-Inpu...

OR you can opt for complex XML editing suggested in this reference - https://community.splunk.com/t5/Dashboards-Visualizations/Remove-ALL-from-multi-select-input-once-an...

I hope this helps!!! Kindly upvote if it does!!!

[sarit_s6]

well, im using splunk cloud so JS is not an option and  i've tries the second option but its not working
maybe something in the copy paste became wrong ? 

      <input type="multiselect" token="categories">
        <label>Categories</label>
        <choice value="*">ALL</choice>
        <fieldForLabel>testCategories</fieldForLabel>
        <fieldForValue>testCategories</fieldForValue>
        <search>
          <query>index="stg_observability_s" sourcetype=SplunkQuality earliest=$time.earliest$ latest=$time.latest$
| search AdditionalData.domain="$domain$"  AdditionalData.pipelineName="$pipelineName$" AdditionalData.buildId="$jobid$" AdditionalData.repoUrl="$repo$" 

| stats count by testCategories</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <default>*</default>
        <initialValue>*</initialValue>
        <delimiter> AND </delimiter>
        <valuePrefix>testCategories="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <change>
          <eval token="form.categories">case(mvcount('form.categories')=0,"All",mvcount('form.categories')&gt;1 AND mvfind('form.categories',"All")&gt;0,"All",mvcount('form.categories')&gt;1 AND mvfind('form.categories',"All")=0,mvfilter('form.categories'!="All"),1==1,'form.categories')</eval>
          <eval token="categories_choice">if('form.categories'=="All","categories=\"*\"",'categories')</eval>
        </change>
      </input>

[ITWhisperer]

It is not so much the copy paste, it is the value used for All, this needs to be "All" not "*" (similarly with the initialValue)

<form version="1.1" theme="light">
  <label>All handling</label>
  <search id="base_search">
    <query>| makeresults format=csv data="categories
A
B
C"
| table categories</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <fieldset submitButton="false">
    <input type="multiselect" token="categories">
      <label>Categories</label>
      <choice value="All">All</choice>
      <default>All</default>
      <initialValue>All</initialValue>
      <fieldForLabel>categories</fieldForLabel>
      <fieldForValue>categories</fieldForValue>
      <search base="base_search">
        <query> |stats count by categories </query>
      </search>
      <valuePrefix>testCategories="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> AND </delimiter>
      <change>
        <eval token="form.categories">case(mvcount('form.categories')=0,"All",mvcount('form.categories')&gt;1 AND mvfind('form.categories',"All")&gt;0,"All",mvcount('form.categories')&gt;1 AND mvfind('form.categories',"All")=0,mvfilter('form.categories'!="All"),1==1,'form.categories')</eval>
        <eval token="categories_choice">if('form.categories'=="All","categories=\"*\"",'categories')</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        Categories:  $categories_choice$
      </html>
    </panel>
  </row>
</form>