Splunk Search

How to filter the values of 5 columns using checkbox?

Hanliamadeus
Explorer

Let's imagine that I have a table as the picture below displayed.
Column 5 listed the column names who have the "YES" value.

Now, I need to create a Checkbox, where lists the column names of "column1" to "column 4", if I click "Column2" option in the checkbox, the table would only display where Column5 has "Column2" value. If I click "Column1" and "Column3", the table will only show where column5 has "Column1/ Column3".

I know how to list all the values of Column 5 in the checkbox, but I just need to show the single value instead of the combined values.
Please tell me how to do that, I hope my explanation is clear, if you are confused, please let me know, thank you very much.

alt text

0 Karma
1 Solution

niketn
Legend

@Hanliamadeus please try the following run anywhere example based on the sample data provided which sets the token $tokColumnFilter$ set through the checkbox:

<form>
  <label>Checkbox Filter</label>
  <fieldset submitButton="false">
    <input type="checkbox" token="tokColumnFilter" searchWhenChanged="true">
      <label>Filter based on Columns</label>
      <choice value="*">All</choice>
      <choice value="Column1">Column1</choice>
      <choice value="Column2">Column2</choice>
      <choice value="Column3">Column3</choice>
      <choice value="Column4">Column4</choice>
      <prefix>Column5="</prefix>
      <suffix>"</suffix>
      <delimiter>/</delimiter>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| fields - _time
| eval data="YES,NO,YES,NO,Column1/Column3;NO,YES,NO,NO,Column2;YES,NO,YES,YES,Column1/Column3/Column4"
| makemv data delim=";"
| mvexpand data
| makemv data delim=","
| eval Column1=mvindex(data,0),
       Column2=mvindex(data,1),
       Column3=mvindex(data,2),
       Column4=mvindex(data,3),
       Column5=mvindex(data,4)
| fields Column*
| search $tokColumnFilter$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@Hanliamadeus please try the following run anywhere example based on the sample data provided which sets the token $tokColumnFilter$ set through the checkbox:

<form>
  <label>Checkbox Filter</label>
  <fieldset submitButton="false">
    <input type="checkbox" token="tokColumnFilter" searchWhenChanged="true">
      <label>Filter based on Columns</label>
      <choice value="*">All</choice>
      <choice value="Column1">Column1</choice>
      <choice value="Column2">Column2</choice>
      <choice value="Column3">Column3</choice>
      <choice value="Column4">Column4</choice>
      <prefix>Column5="</prefix>
      <suffix>"</suffix>
      <delimiter>/</delimiter>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| fields - _time
| eval data="YES,NO,YES,NO,Column1/Column3;NO,YES,NO,NO,Column2;YES,NO,YES,YES,Column1/Column3/Column4"
| makemv data delim=";"
| mvexpand data
| makemv data delim=","
| eval Column1=mvindex(data,0),
       Column2=mvindex(data,1),
       Column3=mvindex(data,2),
       Column4=mvindex(data,3),
       Column5=mvindex(data,4)
| fields Column*
| search $tokColumnFilter$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Hanliamadeus
Explorer

Thank you very much for your help! It's a good solution.

0 Karma

Sukisen1981
Champion

what happens if i just choose column1 ? is it supposed to return rows 1 and 3 as the result? Also, why do you want a check box and not a multiselect input token?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...