Reporting

How to select multiple values in a checkbox for a saved search?

qxu5715
Explorer

I want to build a Dashbaord with a savedsearch and a checkbox input with several values (value1,value2,value3...)

When I am selecting just one value on the UI, the search works fine, but as soon as I'm selecting several values, it is not working anymore. To be honest I am not sure if the reason is my wrong search query or my wrong use of tokens:

<input type="checkbox" token="Token_name" searchWhenChanged="true">
      <label>field1</label>
      <choice value="value1">value1</choice>
      <choice value="value2">value2</choice>
      <choice value="value3">value3</choice>
      <delimiter> OR </delimiter>

<search>
 <query>|savedsearch "saved_Report" |search Value_in_report=$Token_name$</query>
  </search>

I've tried several options of changing the token properties including:

Token Prefix -> (
Token Suffix -> )
Token Value Prefix -> Value_in_report="
Token Value Suffix -> "
Delimiter -> AND,OR

It would be nice, if sb. could explain how the checkbox input is working with several selected values.

Thanks and regards

0 Karma
1 Solution

DalJeanis
Legend

Your later sample should have worked. The only change necessary would seem to be...

|search $Token_name$

One way to debug this would be to add an html display to a panel so that you can see exactly what is being loaded into the checkbox's value. Then open a search screen and paste that into the search where the $Token_name$ is.

View solution in original post

harish_l
New Member

can you please help to select the multiple value, like i need to filter 2 or 3 values out of 6.

This is my search :
|inputlookup target_lookup
| where targetType LIKE("$value$")
| makemv delim="," targetType
|table targetType

Saved search :
| savedsearch filter $value$

Its not working for me. could you please help me to resolve.

0 Karma

DalJeanis
Legend

Your later sample should have worked. The only change necessary would seem to be...

|search $Token_name$

One way to debug this would be to add an html display to a panel so that you can see exactly what is being loaded into the checkbox's value. Then open a search screen and paste that into the search where the $Token_name$ is.

qxu5715
Explorer

Worked well, thanks for the support!

harish_l
New Member

can you please help to select the multiple value, like i need to filter 2 or 3 values out of 6.

This is my search :
|inputlookup target_lookup
| where targetType LIKE("$value$")
| makemv delim="," targetType
|table targetType

Saved search :
| savedsearch filter $value$

Its not working for me. could you please help me to resolve.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...