Solved: How to filter multiselect entries based on its own...

jonvijay1993 · ‎04-13-2023

I have a multiselect for software version (version is just yyyy.mm.dd or an alphanumeric string).

If the user selects a certain version, multiselect has to hide all its entries below selected version, so that user would only see multiselect versions higher than what he selected.

Is this possible?

<input type="multiselect" token="VERSION" searchWhenChanged="true">
      <label>Version</label>
      <fieldForLabel>VERSION</fieldForLabel>
      <fieldForValue>VERSION</fieldForValue>
      <choice value="all">ALL</choice>
      <!--<default>all</default>-->
      <!--<initialValue>all</initialValue>-->
      <valuePrefix>'</valuePrefix>
      <valueSuffix>'</valueSuffix>
      <delimiter> AND </delimiter>
      <change>
         <eval token="form.VERSION">if(mvcount('form.VERSION')=3, mvindex('form.VERSION',0, 1),'form.VERSION')</eval>
      </change>
      <search>
        <query>| dbxquery query="select distinct VERSION from table WHERE blah blah blah" connection="blah" maxrows=0</query>
      </search>
    </input>

Basically we're trying to get a setup for selecting a range of versions, like 2022.01.01 to 2023.01.02 using two multiselect inputs.

yuanliu · ‎04-14-2023

This is one way to do it.

<form version="1.1">
  <label>dynamic multiselect</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="VERSION" searchWhenChanged="true">
      <label>Version</label>
      <fieldForLabel>version</fieldForLabel>
      <fieldForValue>version</fieldForValue>
      <choice value="0">ALL</choice>
      <!--<default>all</default>-->
      <!--<initialValue>all</initialValue>-->
      <delimiter>,</delimiter>
      <search>
        <query>| makeresults count=12
| fields - _time
| streamstats count
| eval version = "2022." . if(count &lt; 10, "0" . count, count)
``` the above emulates data ```
| where version &gt; max($VERSION$)</query>
      </search>
      <initialValue>0</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Version $VERSION$</title>
      <html>
        This is a demonstration for <a href="https://community.splunk.com/t5/Splunk-Search/How-to-filter-multiselect-entries-based-on-its-own-selection/m-p/639756#M221695">How to filter multiselect entries based on its own selection?</a>
      </html>
    </panel>
  </row>
</form>

initial - ready to pick 4pick 4, ready to pick 8pick 8

View solution in original post

yuanliu · ‎04-14-2023

This is one way to do it.

<form version="1.1">
  <label>dynamic multiselect</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="VERSION" searchWhenChanged="true">
      <label>Version</label>
      <fieldForLabel>version</fieldForLabel>
      <fieldForValue>version</fieldForValue>
      <choice value="0">ALL</choice>
      <!--<default>all</default>-->
      <!--<initialValue>all</initialValue>-->
      <delimiter>,</delimiter>
      <search>
        <query>| makeresults count=12
| fields - _time
| streamstats count
| eval version = "2022." . if(count &lt; 10, "0" . count, count)
``` the above emulates data ```
| where version &gt; max($VERSION$)</query>
      </search>
      <initialValue>0</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Version $VERSION$</title>
      <html>
        This is a demonstration for <a href="https://community.splunk.com/t5/Splunk-Search/How-to-filter-multiselect-entries-based-on-its-own-selection/m-p/639756#M221695">How to filter multiselect entries based on its own selection?</a>
      </html>
    </panel>
  </row>
</form>

initial - ready to pick 4pick 4, ready to pick 8pick 8

jonvijay1993 · ‎04-14-2023

Hi, I think your way of filtering based on the query makes sense. The reason why I asked the question in the first place was, I was already doing some <set> operations within <change> and splunk wouldn't allow me to have condition and eval within change tag, and I was clueless. Thanks for the answer, I will try this and post results.

yuanliu · ‎04-14-2023

Your observation is correct. <set> on condition allows you to set a value, not an eval.

jonvijay1993 · ‎04-17-2023

Thank you!

How to filter multiselect entries based on its own selection?

chart

eval

field extraction

fields

timechart

Can’t make it to .conf25? Join us online!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Calling All Security Pros: Ready to Race Through Boston?

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Are you a member of the Splunk Community?

How to filter multiselect entries based on its own selection?

Can’t make it to .conf25? Join us online!