Getting Data In

Dropdown input value to be passed to multiselect inputs


Hi All,

I would like to pass a drop down filter value to multiselect value.
code for dropdown is as :

 <input type="dropdown" token="entity">
          <choice value="*">All</choice>
          <choice value="_time">Time</choice>
          <choice value="_status">Status</choice>

I would like to pass this to "Token value Suffix" of Multiselect filter.

<input type="multiselect" token="servers" searchWhenChanged="true">
        <delimiter> OR </delimiter>
          <query>index="my_index" application=my_app Type=Network   (hostname=*) |rex field=Identifier  "ServerToITSMServerLatency_(?<Server>\w+)\-\w+\_(?<entity>\w+)"|dedup Identifier |stats count by Server</query>
        <choice value="*">All</choice>

My concern is that it runs good for the first time, but next time , token variable looses its identity and is replaced be first time or default value of $entity$.

Please let me know how can i maintain the token variable in multiselect?

0 Karma


Looks like its SPLUNK GUI BUG, When i tried saving this token using XML at backend, it worked!! It was having trouble through Splunk GUI.

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...