"Searching is waiting for input..." for dynamically generated multiselect, even with default "*"

[alvinma]

I have a dashboard that uses a search-powered multiselect for user to filter out result, the source code looks like this:

  <input type="multiselect" token="emaiLtype" searchWhenChanged="true">
    <label>Select one or many email type(s):</label>
    <search>
      <query>index=applogsprd module=communication | stats count by email_type</query>
    </search>
    <default>*</default>
    <fieldForLabel>email_type</fieldForLabel>
    <fieldForValue>email_type</fieldForValue>
    <valuePrefix>emaiL_type=</valuePrefix>
    <valueSuffix></valueSuffix>
    <delimiter> OR </delimiter>
  </input>
  <chart>
    <search>
      <query>index=applogsprd sourcetype=advisor:domain module=communication $emailtype$ | stats count(eval(can_send_email="true" and application="monolith")) AS CAN_SEND_MONO, count(eval(can_send_email="true" and application="microservice")) AS CAN_SEND_MS, count(eval(can_send_email="false" and application="monolith")) AS CANNOT_SEND_MONO, count(eval(can_send_email="false" and application="microservice")) AS CANNOT_SEND_MS by email_type</query>
      <earliest>1510387200</earliest>
      <latest>now</latest>
      <sampleRatio>1</sampleRatio>
    </search>

However, when the dashboard is up, regardless what value user selected in multiselect, it keeps showing "Search is waiting for input..."

I have another dashboard constructed exactly the same way, and that one works. Any idea that what might go wrong?

[kamlesh_vaghela]

Hi

Can you please update input XML and try again?

<input type="multiselect" token="emailtype" searchWhenChanged="true">
     <label>Select one or many email type(s):</label>
     <search>
       <query>index=applogsprd module=communication | stats count by email_type</query>
     </search>
     <default>*</default>
     <fieldForLabel>email_type</fieldForLabel>
     <fieldForValue>email_type</fieldForValue>
     <valuePrefix>emaiL_type=</valuePrefix>
     <valueSuffix></valueSuffix>
     <delimiter> OR </delimiter>
     <choice value="*">*</choice>
   </input>

I have just added <choice value="*">*</choice> and changed emaiLtype to emailtype.

Thanks

[renjith_nair · Accepted solution]

Your token definition is token="emaiLtype" "emaiLtype" with "L" and the token substitution is index=applogsprd sourcetype=advisor:domain module=communication $emailtype$with "l". Not sure if it's a typo but just try changing it

[traxxasbreaker]

Have you tried adding quotes around the value of emailtype to see if that makes a difference? I was battling something similar the other day and it seemed to finally work after I surrounded the token value in quotes even though I wouldn't have normally put quotes there while writing the search.

[alvinma]

Yes, the "L" is causing the "Searching is waiting for input...", change it to "l" makes it go away. However, need to surround the token with " in order to make it work. But it only works with single selected value. In other words:

"email_type=foo" works

"email_type=foo OR email_type=bar" doesn't work, even in the log both email_type "foo" and "bar" exist