Getting Data In

How to filter data by multiselect

quintessence
New Member

I'm trying to use multiselect for filtering my charts data:

search "msg.mdc.headers.consumer{}"=$consumer$

, where $consumer$ is my multiselect token.
But when I have multiple values selected (val1, val2) - the search doesn't work.

0 Karma

vnravikumar
Champion

Hi

Check this sample and try with valuePrefix , valueSuffix and delimiter

<form>
  <label>multiselect</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="sourcetype">
      <label>Source Type</label>
      <valuePrefix>(sourcetype=</valuePrefix>
      <valueSuffix>)</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_internal |stats count by sourcetype</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal $sourcetype$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...