Splunk Search

How to store multiple values in one token and pass into another search

itnewbie
Explorer

I have "Product Brand" multiselect filter in a Splunk dashboard. It is a dynamic filter rather than static. I also have a panel displaying all product brands. Now, I want another conditional panel to display further information of 3 of the brands in the product brand list if user selects any of these 3. 

I know I have to set a <change> and <condition> tag in XML to toggle between the display of panel and store the selected values. I now write three condition tags with set token like this: 

 

      <change>
        <condition match="A">
          <set token="show_product_panel">true</set>
          <set token="show_product">$value$</set>
        </condition>
        <condition value="B">
          <set token="show_product_panel">true</set>
          <set token="show_product">$value$</set>
        </condition>
        <condition value="C">
          <set token="show_product_panel">true</set>
          <set token="show_product">$value$</set>
        </condition>
        <condition>
          <unset token="show_product_panel"></unset>
          <unset token="show_product"></unset>
        </condition>
      </change>

 

However, I want the $show_product$ to hold multiple values instead of one, as it is a multiselect filter. How should I do so? I have tried something in each of the condition like but won't work. How can I "append" the values into $show_product$? Thanks.

 

<eval token="show_product">if(isnull($show_product$), $value$, $show_product$.", ".$value$)</eval>

 

 

FYI: the $show_product$ will be passed into the conditional panel like this

 

<row depends="$show_product_panel$">
    <panel>
        <chart>
            <search>
                <query>index IN ("A_a", "A_b")
                    | where match(index, "A_" + $subsidiary$)
                    | dedup id sortby _time
                    | eval "Product Brand" = coalesce('someFieldA',
                    'someFieldB')
                    | search "Product Brand" IN ($show_product$)
                    | timechart span=1mon count by "Product Brand"</query>
                <earliest>$field1.earliest$</earliest>
                <latest>$field1.latest$</latest>
            </search>
            <option name="charting.chart">column</option>
            <option name="charting.drilldown">none</option>
            <option name="refresh.display">progressbar</option>
        </chart>
    </panel>
</row>

 

 

FYI: Product Brand XML code snippet:

 

    <input type="multiselect" token="product_brand" searchWhenChanged="true">
      <label>Product Brand</label>
      <fieldForLabel>brand_combine</fieldForLabel>
      <fieldForValue>brand_combine</fieldForValue>
      <search>
        <query>index IN ("A","B")
| eval brand_combine = coalesce('someFieldA','someFieldB')
| search brand_combine != null
| where match(index, "zendesk_ticket_"  + $subsidiary$) 
| dedup brand_combine
| fields brand_combine</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <delimiter>,</delimiter>
      <change>
        <condition match="A">
          <set token="show_product_panel">true</set>
          <set token="show_product">$value$</set>
        </condition>
        <condition value="B">
          <set token="show_product_panel">true</set>
          <set token="show_product">$value$</set>
        </condition>
        <condition value="C">
          <set token="show_product_panel">true</set>
          <set token="show_product">$value$</set>
        </condition>
        <condition>
          <unset token="show_product_panel"></unset>
          <unset token="show_product"></unset>
        </condition>
      </change>
    </input>

 

Labels (1)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The product_brand token already holds the chosen values.

You can use the prefix, suffix, valuePrefix, valueSuffix and delimiter options to determine how the token is formatted.

Simple XML Reference - Splunk Documentation

0 Karma

itnewbie
Explorer

@ITWhisperer Thanks for the reply. Given I use $product_brand$ in the conditional panel now, I still need to set the condition of displaying the panel. At the <condition> tag, how can I set it to accept multiple values? As the above method only accepts a single value at one time, I want it to be

if $procut_brand$ IN ANY of product brand ["A", "B", "C"], set the display panel to true

and if not in those 3, just don't display. Any nudge in the right direction? Many thanks. 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...