Splunk Search

How to create a chart that shows multiple values by default, but have a multiselect drop-down to drill down to a specific value?

jhayIV
Engager

I am trying to provide a chart that shows multiple locations as a default, then allow them to use the multiselect to drill down to a specific location. Can someone tell me what I am doing wrong? I am getting No Results Found

The working search looks like this:

table Location,Server_Name,Server_OS_Name|search Location="FORT WORTH RDC" OR "CROSSINGS RDC" |chart count(Server_Name) by Server_OS_Name|

When I set up the drop-down, the search doesn't work:

table Location,Server_Name,Server_OS_Name|search Location="FORT WORTH RDC CROSSINGS RDC" |chart count(Server_Name) by Server_OS_Name|

I tried putting quotes in the Prefix and Suffix
alt text

0 Karma
1 Solution

sundareshr
Legend

The values returned by the multi-select dropdown is not in the right format for the search. You need to add the right Prefix & SUffix. Try this

Token Prefix=(
Token Suffix=)
Token Value Prefix=Location="
Token Value Suffix=" OR  (there is a space before and after OR)

So when you set the token value, it should look like this (Location="Fort Worth" OR Location="Dallas")

View solution in original post

sundareshr
Legend

The values returned by the multi-select dropdown is not in the right format for the search. You need to add the right Prefix & SUffix. Try this

Token Prefix=(
Token Suffix=)
Token Value Prefix=Location="
Token Value Suffix=" OR  (there is a space before and after OR)

So when you set the token value, it should look like this (Location="Fort Worth" OR Location="Dallas")

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.