Splunk Search

How to count number of values in multi-valued field , dynamically?

vijay_k
Engager

<input type="multiselect" token="product_token" searchWhenChanged="true">
<label>Product types</label>
<choice value="*">All</choice>
<default>*</default>
<prefix>(</prefix>
<suffix>)</suffix>
<initialValue>*</initialValue>
<valuePrefix>DB_Product="*</valuePrefix>
<valueSuffix>*"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>DB_Product</fieldForLabel>
<fieldForValue>DB_Product</fieldForValue>
<search base="base_search_Products">
<query>|dedup DB_Product | table DB_Product</query>
</search>
</input>

 

This is my input multi select , thorugh which user select product Types example - All /A,B,C,D etc

I need to count, How many Product types are selcted by user . This info i need for further processing.

Labels (1)
Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@vijay_k 

Are you looking for something like this? Just try this example.

<form version="1.1">
  <label>Test</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="product_token" searchWhenChanged="true">
      <label>Product types</label>
      <choice value="*">All</choice>
      <default>*</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <initialValue>*</initialValue>
      <valuePrefix>DB_Product="*</valuePrefix>
      <valueSuffix>*"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>DB_Product</fieldForLabel>
      <fieldForValue>DB_Product</fieldForValue>
      <search>
        <query>| makeresults count=10 
                | eval a=1 
                | accum a
                | eval DB_Product="DB_PR_"+a | table DB_Product</query>
      </search>
      <change>
        <condition match="$form.product_token$==&quot;*&quot;">
          <eval token="tmp">$form.product_token$</eval>
          <eval token="select_count">mvcount('form.product_token')</eval>
        </condition>
        <condition>
          <eval token="tmp">mvcount('form.product_token')</eval>
          <eval token="select_count">mvcount('form.product_token')</eval>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=10 
                | eval a=1 
                | accum a
                | eval DB_Product="DB_PR_"+a | table DB_Product 
| search $product_token$
| eval count="$select_count$"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

 

I hope this will help you.

 

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<change>
  <eval token="select_count">mvcount('form.product_token')</eval>
</change>

vijay_k
Engager

<input type="multiselect" token="product_token" searchWhenChanged="true">
<label>Product types</label>
<choice value="*">All</choice>
<default>*</default>
<prefix>(</prefix>
<suffix>)</suffix>
<initialValue>*</initialValue>
<valuePrefix>DB_Product="*</valuePrefix>
<valueSuffix>*"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>DB_Product</fieldForLabel>
<fieldForValue>DB_Product</fieldForValue>
<search base="base_search_Products">
<query>|dedup DB_Product | table DB_Product</query>
</search>

<change>
  <eval token="select_count">mvcount('form.product_token')</eval>
</change>


</input>

 

I added change tag within input but it gives values NULL

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How are you using the token?

0 Karma

vijay_k
Engager

index="example" source="Stash_test"|search  $product_token$
|eval countn=$select_count$

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...