Splunk Enterprise

Count selected items in Multiselect

dataisbeautiful
Path Finder

Hi all

I'm trying to count the number of selected items in a Multiselect control. I've tried eval and stats but no luck with either 😞

 

| eval selected_total = count($element$)

 

 

| stats count($element$) as selected_total

 

 

 

Thanks

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

As @ITWhisperer , you should use $form.element$ - the $form.element$ variant of the token is the one that holds the values of the selections, whereas the base $element$ holds the final full expanded token with all the prefixes, suffixed and delimiter, see your slightly modified example.

<form version="1.1" theme="light">
  <label>test2</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="element" searchWhenChanged="true">
      <label>Fruit Select</label>
      <choice value="a">Apple</choice>
      <choice value="b">Banana</choice>
      <choice value="c">Coconut</choice>
      <choice value="d">Dragonfruit</choice>
      <choice value="e">Elderberry</choice>
      <choice value="f">Fig</choice>
      <choice value="g">Grape</choice>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>, </delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Form element::$form.element$, Element::$element$</title>
      <single>
        <title>Number of selected fruit</title>
        <search>
          <query>| makeresults
          | eval selected_total=mvcount(split($form.element|s$,","))
| table selected_total</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
  </row>
</form>

I am not sure if the| eval selected_total=mvcount(split($form.element|s$,",")) would work also in dashboard studio also.

 

View solution in original post

dataisbeautiful
Path Finder
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| eval selected_total = mvcount($form.element$)
0 Karma

dataisbeautiful
Path Finder

Hi @ITWhisperer 

That didn't work unfortunately, gave the following error

Set token value to render visualization
$form.element$

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please provide more information such as the source of your dashboard

0 Karma

dataisbeautiful
Path Finder

Sample dashboard

{
    "visualizations": {
        "viz_3hKq7uoX": {
            "type": "splunk.singlevalue",
            "options": {},
            "dataSources": {
                "primary": "ds_a2mWNgri"
            }
        },
        "viz_JUFcFWVl": {
            "type": "splunk.singlevalue",
            "options": {},
            "dataSources": {
                "primary": "ds_LbaP4o2H"
            }
        }
    },
    "dataSources": {
        "ds_a2mWNgri": {
            "type": "ds.search",
            "options": {
                "query": "| makeresults\n| eval selected_total = count($element$)\n| table selected_total"
            },
            "name": "Search_eval"
        },
        "ds_LbaP4o2H": {
            "type": "ds.search",
            "options": {
                "query": "| makeresults\n| stats count($element$) as selected_total\n| table selected_total"
            },
            "name": "Search_stats"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "latest": "$global_time.latest$",
                        "earliest": "$global_time.earliest$"
                    }
                }
            }
        }
    },
    "inputs": {
        "input_global_trp": {
            "type": "input.timerange",
            "options": {
                "token": "global_time",
                "defaultValue": "-24h@h,now"
            },
            "title": "Global Time Range"
        },
        "input_QDGCxYVt": {
            "options": {
                "items": [
                    {
                        "label": "Apple",
                        "value": "a"
                    },
                    {
                        "label": "Banana",
                        "value": "b"
                    },
                    {
                        "label": "Coconut",
                        "value": "c"
                    },
                    {
                        "label": "Dragonfruit",
                        "value": "d"
                    },
                    {
                        "label": "Elderberry",
                        "value": "e"
                    },
                    {
                        "label": "Fig",
                        "value": "f"
                    },
                    {
                        "label": "Grape",
                        "value": "g"
                    }
                ],
                "token": "element"
            },
            "title": "Select something",
            "type": "input.multiselect"
        }
    },
    "layout": {
        "type": "absolute",
        "options": {
            "width": 1440,
            "height": 960,
            "display": "auto"
        },
        "structure": [
            {
                "item": "viz_3hKq7uoX",
                "type": "block",
                "position": {
                    "x": 20,
                    "y": 20,
                    "w": 250,
                    "h": 250
                }
            },
            {
                "item": "viz_JUFcFWVl",
                "type": "block",
                "position": {
                    "x": 290,
                    "y": 20,
                    "w": 250,
                    "h": 250
                }
            }
        ],
        "globalInputs": [
            "input_global_trp",
            "input_QDGCxYVt"
        ]
    },
    "description": "test",
    "title": "test"
}
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you build your dashboard in SimpleXML / Classic (as token management is a little better there)?

0 Karma

dataisbeautiful
Path Finder

Here's a sample in classic, still can't figure out how to count the number of selected items.

 

<form version="1.1" theme="light">
  <label>test2</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="element" searchWhenChanged="true">
      <label>Fruit Select</label>
      <choice value="a">Apple</choice>
      <choice value="b">Banana</choice>
      <choice value="c">Coconut</choice>
      <choice value="d">Dragonfruit</choice>
      <choice value="e">Elderberry</choice>
      <choice value="f">Fig</choice>
      <choice value="g">Grape</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>Number of selected fruit</title>
        <search>
          <query>| makeresults
| stats count($element$) as selected_total
| table selected_total</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
  </row>
</form>

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

As @ITWhisperer , you should use $form.element$ - the $form.element$ variant of the token is the one that holds the values of the selections, whereas the base $element$ holds the final full expanded token with all the prefixes, suffixed and delimiter, see your slightly modified example.

<form version="1.1" theme="light">
  <label>test2</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="element" searchWhenChanged="true">
      <label>Fruit Select</label>
      <choice value="a">Apple</choice>
      <choice value="b">Banana</choice>
      <choice value="c">Coconut</choice>
      <choice value="d">Dragonfruit</choice>
      <choice value="e">Elderberry</choice>
      <choice value="f">Fig</choice>
      <choice value="g">Grape</choice>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>, </delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Form element::$form.element$, Element::$element$</title>
      <single>
        <title>Number of selected fruit</title>
        <search>
          <query>| makeresults
          | eval selected_total=mvcount(split($form.element|s$,","))
| table selected_total</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
  </row>
</form>

I am not sure if the| eval selected_total=mvcount(split($form.element|s$,",")) would work also in dashboard studio also.

 

bowesmana
SplunkTrust
SplunkTrust

And you can also add a <change> element in the multiselect, which although officially unsupported, does work, i.e. this

      <change>
        <eval token="selections">mvcount($form.element$)</eval>
      </change>

Note that you don't need the split here as the $form.element$ is only flattened in the token assignment in the SPL

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...