Getting Data In

How to filter data by multiselect

quintessence
New Member

I'm trying to use multiselect for filtering my charts data:

search "msg.mdc.headers.consumer{}"=$consumer$

, where $consumer$ is my multiselect token.
But when I have multiple values selected (val1, val2) - the search doesn't work.

0 Karma

vnravikumar
Champion

Hi

Check this sample and try with valuePrefix , valueSuffix and delimiter

<form>
  <label>multiselect</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="sourcetype">
      <label>Source Type</label>
      <valuePrefix>(sourcetype=</valuePrefix>
      <valueSuffix>)</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_internal |stats count by sourcetype</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal $sourcetype$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...