Getting Data In

Dropdown input value to be passed to multiselect inputs


Hi All,

I would like to pass a drop down filter value to multiselect value.
code for dropdown is as :

 <input type="dropdown" token="entity">
          <choice value="*">All</choice>
          <choice value="_time">Time</choice>
          <choice value="_status">Status</choice>

I would like to pass this to "Token value Suffix" of Multiselect filter.

<input type="multiselect" token="servers" searchWhenChanged="true">
        <delimiter> OR </delimiter>
          <query>index="my_index" application=my_app Type=Network   (hostname=*) |rex field=Identifier  "ServerToITSMServerLatency_(?<Server>\w+)\-\w+\_(?<entity>\w+)"|dedup Identifier |stats count by Server</query>
        <choice value="*">All</choice>

My concern is that it runs good for the first time, but next time , token variable looses its identity and is replaced be first time or default value of $entity$.

Please let me know how can i maintain the token variable in multiselect?

0 Karma


Looks like its SPLUNK GUI BUG, When i tried saving this token using XML at backend, it worked!! It was having trouble through Splunk GUI.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...