Splunk Search

How to search multiple items from multiselect input in Dashboard studio?

amanda_dg
Engager
Hi everyone, 
 
When I search for multiple items from multiselect, it is not working. I can search for "ALL" or one item only but not multiple items. 
Here is the search:
 index="billing_sales" source="produced_movie" NAME_ENG IN ("$field1$")
| stats sum(AMOUNT) as TOTAL
 
How do I change the above search so that I can look up multiple field1s?
 
 
{
    "visualizations": {
        "viz_7sJt3IPY": {
            "type""splunk.singlevalue",
            "options": {
                "backgroundColor""transparent",
                "majorColor""#f8be44"
            },
            "dataSources": {
                "primary""ds_i9R3dB04"
            }
        }
    },
    "dataSources": {
        "ds_DCcDyt7v": {
            "type""ds.search",
            "options": {
                "query""index=\"billing_sales\" source=\"produced_movie_ddish\" \n| table CARD_NUMBER, NAME_ENG, DESCR, AMOUNT, PRODUCT_ID, TRANS_DATE, CONTENT_ID, PRODUCT_ID"
            },
            "name""Search_1"
        },
        "ds_dCpthBJm": {
            "type""ds.chain",
            "options": {
                "extend""ds_DCcDyt7v",
                "query""| stats count by NAME_ENG"
            },
            "name""content_name"
        },
        "ds_i9R3dB04": {
            "type""ds.search",
            "options": {
                "query""index=\"billing_sales\" source=\"produced_movie_ddish\" NAME_ENG IN (\"$field1$\") \n| stats sum(AMOUNT) as DDISH_TOTAL"
            },
            "name""Search_2"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "latest""$global_time.latest$",
                        "earliest""$global_time.earliest$"
                    }
                }
            }
        }
    },
    "inputs": {
        "input_global_trp": {
            "type""input.timerange",
            "options": {
                "token""global_time",
                "defaultValue""-24h@h,now"
            },
            "title""Global Time Range"
        },
        "input_1PggimcS": {
            "options": {
                "items": [
                    {
                        "label""All",
                        "value""*"
                    }
                ],
                "defaultValue""*",
                "token""field1",
                "clearDefaultOnSelection"true
            },
            "dataSources": {
                "primary""ds_dCpthBJm"
            },
            "title""CONTENT_NAME",
            "context": {
                "formattedConfig": {
                    "number": {
                        "prefix"""
                    }
                }
            },
            "type""input.multiselect"
        }
    },
    "layout": {
        "type""absolute",
        "options": {
            "display""auto-scale",
            "backgroundColor""#294e70"
        },
        "structure": [
            {
                "item""viz_7sJt3IPY",
                "type""block",
                "position": {
                    "x"20,
                    "y"10,
                    "w"200,
                    "h"90
                }
            }
        ],
        "globalInputs": [
            "input_global_trp",
            "input_1PggimcS"
        ]
    },
    "description""",
    "title""content_producing_report"
}
Labels (2)
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...