Reporting

How to select multiple values in a checkbox for a saved search?

qxu5715
Explorer

I want to build a Dashbaord with a savedsearch and a checkbox input with several values (value1,value2,value3...)

When I am selecting just one value on the UI, the search works fine, but as soon as I'm selecting several values, it is not working anymore. To be honest I am not sure if the reason is my wrong search query or my wrong use of tokens:

<input type="checkbox" token="Token_name" searchWhenChanged="true">
      <label>field1</label>
      <choice value="value1">value1</choice>
      <choice value="value2">value2</choice>
      <choice value="value3">value3</choice>
      <delimiter> OR </delimiter>

<search>
 <query>|savedsearch "saved_Report" |search Value_in_report=$Token_name$</query>
  </search>

I've tried several options of changing the token properties including:

Token Prefix -> (
Token Suffix -> )
Token Value Prefix -> Value_in_report="
Token Value Suffix -> "
Delimiter -> AND,OR

It would be nice, if sb. could explain how the checkbox input is working with several selected values.

Thanks and regards

0 Karma
1 Solution

DalJeanis
Legend

Your later sample should have worked. The only change necessary would seem to be...

|search $Token_name$

One way to debug this would be to add an html display to a panel so that you can see exactly what is being loaded into the checkbox's value. Then open a search screen and paste that into the search where the $Token_name$ is.

View solution in original post

harish_l
New Member

can you please help to select the multiple value, like i need to filter 2 or 3 values out of 6.

This is my search :
|inputlookup target_lookup
| where targetType LIKE("$value$")
| makemv delim="," targetType
|table targetType

Saved search :
| savedsearch filter $value$

Its not working for me. could you please help me to resolve.

0 Karma

DalJeanis
Legend

Your later sample should have worked. The only change necessary would seem to be...

|search $Token_name$

One way to debug this would be to add an html display to a panel so that you can see exactly what is being loaded into the checkbox's value. Then open a search screen and paste that into the search where the $Token_name$ is.

qxu5715
Explorer

Worked well, thanks for the support!

harish_l
New Member

can you please help to select the multiple value, like i need to filter 2 or 3 values out of 6.

This is my search :
|inputlookup target_lookup
| where targetType LIKE("$value$")
| makemv delim="," targetType
|table targetType

Saved search :
| savedsearch filter $value$

Its not working for me. could you please help me to resolve.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...