Getting Data In

Dropdown input value to be passed to multiselect inputs


Hi All,

I would like to pass a drop down filter value to multiselect value.
code for dropdown is as :

 <input type="dropdown" token="entity">
          <choice value="*">All</choice>
          <choice value="_time">Time</choice>
          <choice value="_status">Status</choice>

I would like to pass this to "Token value Suffix" of Multiselect filter.

<input type="multiselect" token="servers" searchWhenChanged="true">
        <delimiter> OR </delimiter>
          <query>index="my_index" application=my_app Type=Network   (hostname=*) |rex field=Identifier  "ServerToITSMServerLatency_(?<Server>\w+)\-\w+\_(?<entity>\w+)"|dedup Identifier |stats count by Server</query>
        <choice value="*">All</choice>

My concern is that it runs good for the first time, but next time , token variable looses its identity and is replaced be first time or default value of $entity$.

Please let me know how can i maintain the token variable in multiselect?

0 Karma


Looks like its SPLUNK GUI BUG, When i tried saving this token using XML at backend, it worked!! It was having trouble through Splunk GUI.

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...