Getting Data In

Dropdown input value to be passed to multiselect inputs


Hi All,

I would like to pass a drop down filter value to multiselect value.
code for dropdown is as :

 <input type="dropdown" token="entity">
          <choice value="*">All</choice>
          <choice value="_time">Time</choice>
          <choice value="_status">Status</choice>

I would like to pass this to "Token value Suffix" of Multiselect filter.

<input type="multiselect" token="servers" searchWhenChanged="true">
        <delimiter> OR </delimiter>
          <query>index="my_index" application=my_app Type=Network   (hostname=*) |rex field=Identifier  "ServerToITSMServerLatency_(?<Server>\w+)\-\w+\_(?<entity>\w+)"|dedup Identifier |stats count by Server</query>
        <choice value="*">All</choice>

My concern is that it runs good for the first time, but next time , token variable looses its identity and is replaced be first time or default value of $entity$.

Please let me know how can i maintain the token variable in multiselect?

0 Karma


Looks like its SPLUNK GUI BUG, When i tried saving this token using XML at backend, it worked!! It was having trouble through Splunk GUI.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...