Hi everyone,
When I search for multiple items from multiselect, it is not working. I can search for "ALL" or one item only but not multiple items.
Here is the search:
index="billing_sales" source="produced_movie" NAME_ENG IN ("$field1$")
| stats sum(AMOUNT) as TOTAL
How do I change the above search so that I can look up multiple field1s?
{
"visualizations": {
"viz_7sJt3IPY": {
"type": "splunk.singlevalue",
"options": {
"backgroundColor": "transparent",
"majorColor": "#f8be44"
},
"dataSources": {
"primary": "ds_i9R3dB04"
}
}
},
"dataSources": {
"ds_DCcDyt7v": {
"type": "ds.search",
"options": {
"query": "index=\"billing_sales\" source=\"produced_movie_ddish\" \n| table CARD_NUMBER, NAME_ENG, DESCR, AMOUNT, PRODUCT_ID, TRANS_DATE, CONTENT_ID, PRODUCT_ID"
},
"name": "Search_1"
},
"ds_dCpthBJm": {
"type": "ds.chain",
"options": {
"extend": "ds_DCcDyt7v",
"query": "| stats count by NAME_ENG"
},
"name": "content_name"
},
"ds_i9R3dB04": {
"type": "ds.search",
"options": {
"query": "index=\"billing_sales\" source=\"produced_movie_ddish\" NAME_ENG IN (\"$field1$\") \n| stats sum(AMOUNT) as DDISH_TOTAL"
},
"name": "Search_2"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
}
}
}
}
},
"inputs": {
"input_global_trp": {
"type": "input.timerange",
"options": {
"token": "global_time",
"defaultValue": "-24h@h,now"
},
"title": "Global Time Range"
},
"input_1PggimcS": {
"options": {
"items": [
{
"label": "All",
"value": "*"
}
],
"defaultValue": "*",
"token": "field1",
"clearDefaultOnSelection": true
},
"dataSources": {
"primary": "ds_dCpthBJm"
},
"title": "CONTENT_NAME",
"context": {
"formattedConfig": {
"number": {
"prefix": ""
}
}
},
"type": "input.multiselect"
}
},
"layout": {
"type": "absolute",
"options": {
"display": "auto-scale",
"backgroundColor": "#294e70"
},
"structure": [
{
"item": "viz_7sJt3IPY",
"type": "block",
"position": {
"x": 20,
"y": 10,
"w": 200,
"h": 90
}
}
],
"globalInputs": [
"input_global_trp",
"input_1PggimcS"
]
},
"description": "",
"title": "content_producing_report"
}