Splunk Search

How to create a chart that shows multiple values by default, but have a multiselect drop-down to drill down to a specific value?

jhayIV
Engager

I am trying to provide a chart that shows multiple locations as a default, then allow them to use the multiselect to drill down to a specific location. Can someone tell me what I am doing wrong? I am getting No Results Found

The working search looks like this:

table Location,Server_Name,Server_OS_Name|search Location="FORT WORTH RDC" OR "CROSSINGS RDC" |chart count(Server_Name) by Server_OS_Name|

When I set up the drop-down, the search doesn't work:

table Location,Server_Name,Server_OS_Name|search Location="FORT WORTH RDC CROSSINGS RDC" |chart count(Server_Name) by Server_OS_Name|

I tried putting quotes in the Prefix and Suffix
alt text

0 Karma
1 Solution

sundareshr
Legend

The values returned by the multi-select dropdown is not in the right format for the search. You need to add the right Prefix & SUffix. Try this

Token Prefix=(
Token Suffix=)
Token Value Prefix=Location="
Token Value Suffix=" OR  (there is a space before and after OR)

So when you set the token value, it should look like this (Location="Fort Worth" OR Location="Dallas")

View solution in original post

sundareshr
Legend

The values returned by the multi-select dropdown is not in the right format for the search. You need to add the right Prefix & SUffix. Try this

Token Prefix=(
Token Suffix=)
Token Value Prefix=Location="
Token Value Suffix=" OR  (there is a space before and after OR)

So when you set the token value, it should look like this (Location="Fort Worth" OR Location="Dallas")

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...