Solved: How to filter multiselect entries based on its own...

jonvijay1993 · ‎04-13-2023

I have a multiselect for software version (version is just yyyy.mm.dd or an alphanumeric string).

If the user selects a certain version, multiselect has to hide all its entries below selected version, so that user would only see multiselect versions higher than what he selected.

Is this possible?

<input type="multiselect" token="VERSION" searchWhenChanged="true">
      <label>Version</label>
      <fieldForLabel>VERSION</fieldForLabel>
      <fieldForValue>VERSION</fieldForValue>
      <choice value="all">ALL</choice>
      <!--<default>all</default>-->
      <!--<initialValue>all</initialValue>-->
      <valuePrefix>'</valuePrefix>
      <valueSuffix>'</valueSuffix>
      <delimiter> AND </delimiter>
      <change>
         <eval token="form.VERSION">if(mvcount('form.VERSION')=3, mvindex('form.VERSION',0, 1),'form.VERSION')</eval>
      </change>
      <search>
        <query>| dbxquery query="select distinct VERSION from table WHERE blah blah blah" connection="blah" maxrows=0</query>
      </search>
    </input>

Basically we're trying to get a setup for selecting a range of versions, like 2022.01.01 to 2023.01.02 using two multiselect inputs.

yuanliu · ‎04-14-2023

This is one way to do it.

<form version="1.1">
  <label>dynamic multiselect</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="VERSION" searchWhenChanged="true">
      <label>Version</label>
      <fieldForLabel>version</fieldForLabel>
      <fieldForValue>version</fieldForValue>
      <choice value="0">ALL</choice>
      <!--<default>all</default>-->
      <!--<initialValue>all</initialValue>-->
      <delimiter>,</delimiter>
      <search>
        <query>| makeresults count=12
| fields - _time
| streamstats count
| eval version = "2022." . if(count &lt; 10, "0" . count, count)
``` the above emulates data ```
| where version &gt; max($VERSION$)</query>
      </search>
      <initialValue>0</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Version $VERSION$</title>
      <html>
        This is a demonstration for <a href="https://community.splunk.com/t5/Splunk-Search/How-to-filter-multiselect-entries-based-on-its-own-selection/m-p/639756#M221695">How to filter multiselect entries based on its own selection?</a>
      </html>
    </panel>
  </row>
</form>

initial - ready to pick 4pick 4, ready to pick 8pick 8

View solution in original post

yuanliu · ‎04-14-2023

This is one way to do it.

<form version="1.1">
  <label>dynamic multiselect</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="VERSION" searchWhenChanged="true">
      <label>Version</label>
      <fieldForLabel>version</fieldForLabel>
      <fieldForValue>version</fieldForValue>
      <choice value="0">ALL</choice>
      <!--<default>all</default>-->
      <!--<initialValue>all</initialValue>-->
      <delimiter>,</delimiter>
      <search>
        <query>| makeresults count=12
| fields - _time
| streamstats count
| eval version = "2022." . if(count &lt; 10, "0" . count, count)
``` the above emulates data ```
| where version &gt; max($VERSION$)</query>
      </search>
      <initialValue>0</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Version $VERSION$</title>
      <html>
        This is a demonstration for <a href="https://community.splunk.com/t5/Splunk-Search/How-to-filter-multiselect-entries-based-on-its-own-selection/m-p/639756#M221695">How to filter multiselect entries based on its own selection?</a>
      </html>
    </panel>
  </row>
</form>

initial - ready to pick 4pick 4, ready to pick 8pick 8

jonvijay1993 · ‎04-14-2023

Hi, I think your way of filtering based on the query makes sense. The reason why I asked the question in the first place was, I was already doing some <set> operations within <change> and splunk wouldn't allow me to have condition and eval within change tag, and I was clueless. Thanks for the answer, I will try this and post results.

yuanliu · ‎04-14-2023

Your observation is correct. <set> on condition allows you to set a value, not an eval.

jonvijay1993 · ‎04-17-2023

Thank you!

How to filter multiselect entries based on its own selection?

chart

eval

field extraction

fields

other

timechart

Announcing Scheduled Export GA for Dashboard Studio

Extending Observability Content to Splunk Cloud

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!