Reporting

How to select multiple values in a checkbox for a saved search?

qxu5715
Explorer

I want to build a Dashbaord with a savedsearch and a checkbox input with several values (value1,value2,value3...)

When I am selecting just one value on the UI, the search works fine, but as soon as I'm selecting several values, it is not working anymore. To be honest I am not sure if the reason is my wrong search query or my wrong use of tokens:

<input type="checkbox" token="Token_name" searchWhenChanged="true">
      <label>field1</label>
      <choice value="value1">value1</choice>
      <choice value="value2">value2</choice>
      <choice value="value3">value3</choice>
      <delimiter> OR </delimiter>

<search>
 <query>|savedsearch "saved_Report" |search Value_in_report=$Token_name$</query>
  </search>

I've tried several options of changing the token properties including:

Token Prefix -> (
Token Suffix -> )
Token Value Prefix -> Value_in_report="
Token Value Suffix -> "
Delimiter -> AND,OR

It would be nice, if sb. could explain how the checkbox input is working with several selected values.

Thanks and regards

0 Karma
1 Solution

DalJeanis
Legend

Your later sample should have worked. The only change necessary would seem to be...

|search $Token_name$

One way to debug this would be to add an html display to a panel so that you can see exactly what is being loaded into the checkbox's value. Then open a search screen and paste that into the search where the $Token_name$ is.

View solution in original post

harish_l
New Member

can you please help to select the multiple value, like i need to filter 2 or 3 values out of 6.

This is my search :
|inputlookup target_lookup
| where targetType LIKE("$value$")
| makemv delim="," targetType
|table targetType

Saved search :
| savedsearch filter $value$

Its not working for me. could you please help me to resolve.

0 Karma

DalJeanis
Legend

Your later sample should have worked. The only change necessary would seem to be...

|search $Token_name$

One way to debug this would be to add an html display to a panel so that you can see exactly what is being loaded into the checkbox's value. Then open a search screen and paste that into the search where the $Token_name$ is.

qxu5715
Explorer

Worked well, thanks for the support!

harish_l
New Member

can you please help to select the multiple value, like i need to filter 2 or 3 values out of 6.

This is my search :
|inputlookup target_lookup
| where targetType LIKE("$value$")
| makemv delim="," targetType
|table targetType

Saved search :
| savedsearch filter $value$

Its not working for me. could you please help me to resolve.

0 Karma
Get Updates on the Splunk Community!

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...