Why is multiselect not working?

[POR160893]

Hi,

I am using a multiselect input with the following query:
|inputlookup ABC
| eval hjk=_key
| lookup XYZ asset OUTPUT ass AS name, app AS application
| stats values( application)

However, when I add this onto the actual dashboard, no results are generated as expected on the actual input.


What am I doing incorrectly?

Thanks,

[gcusello]

Hi @POR160893,

some additional info to debug your issue:

are you sure to have the asset field also in the first lookup?

in the screenshout I see that asset field is also in output and this is different than the search you shared, is it correct?

then, instead the last row, you could use 

|  stats BY application

or 

| dedup application,
| sort application
| table application

then, why do you used "| eval hjk=_key" ?

Ciao.

Giuseppe

[kamlesh_vaghela]

@POR160893 

It looks  your search out is multivalued field and the column you have used in fieldLabel and fieldValue looks different. can you please verify the search output and the fields you have used in the MultiSelect configurations?

Thanks
KV


If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.