Splunk Search

How to store multiple values in one token and pass into another search

itnewbie
Explorer

I have "Product Brand" multiselect filter in a Splunk dashboard. It is a dynamic filter rather than static. I also have a panel displaying all product brands. Now, I want another conditional panel to display further information of 3 of the brands in the product brand list if user selects any of these 3. 

I know I have to set a <change> and <condition> tag in XML to toggle between the display of panel and store the selected values. I now write three condition tags with set token like this: 

 

      <change>
        <condition match="A">
          <set token="show_product_panel">true</set>
          <set token="show_product">$value$</set>
        </condition>
        <condition value="B">
          <set token="show_product_panel">true</set>
          <set token="show_product">$value$</set>
        </condition>
        <condition value="C">
          <set token="show_product_panel">true</set>
          <set token="show_product">$value$</set>
        </condition>
        <condition>
          <unset token="show_product_panel"></unset>
          <unset token="show_product"></unset>
        </condition>
      </change>

 

However, I want the $show_product$ to hold multiple values instead of one, as it is a multiselect filter. How should I do so? I have tried something in each of the condition like but won't work. How can I "append" the values into $show_product$? Thanks.

 

<eval token="show_product">if(isnull($show_product$), $value$, $show_product$.", ".$value$)</eval>

 

 

FYI: the $show_product$ will be passed into the conditional panel like this

 

<row depends="$show_product_panel$">
    <panel>
        <chart>
            <search>
                <query>index IN ("A_a", "A_b")
                    | where match(index, "A_" + $subsidiary$)
                    | dedup id sortby _time
                    | eval "Product Brand" = coalesce('someFieldA',
                    'someFieldB')
                    | search "Product Brand" IN ($show_product$)
                    | timechart span=1mon count by "Product Brand"</query>
                <earliest>$field1.earliest$</earliest>
                <latest>$field1.latest$</latest>
            </search>
            <option name="charting.chart">column</option>
            <option name="charting.drilldown">none</option>
            <option name="refresh.display">progressbar</option>
        </chart>
    </panel>
</row>

 

 

FYI: Product Brand XML code snippet:

 

    <input type="multiselect" token="product_brand" searchWhenChanged="true">
      <label>Product Brand</label>
      <fieldForLabel>brand_combine</fieldForLabel>
      <fieldForValue>brand_combine</fieldForValue>
      <search>
        <query>index IN ("A","B")
| eval brand_combine = coalesce('someFieldA','someFieldB')
| search brand_combine != null
| where match(index, "zendesk_ticket_"  + $subsidiary$) 
| dedup brand_combine
| fields brand_combine</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <delimiter>,</delimiter>
      <change>
        <condition match="A">
          <set token="show_product_panel">true</set>
          <set token="show_product">$value$</set>
        </condition>
        <condition value="B">
          <set token="show_product_panel">true</set>
          <set token="show_product">$value$</set>
        </condition>
        <condition value="C">
          <set token="show_product_panel">true</set>
          <set token="show_product">$value$</set>
        </condition>
        <condition>
          <unset token="show_product_panel"></unset>
          <unset token="show_product"></unset>
        </condition>
      </change>
    </input>

 

Labels (1)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The product_brand token already holds the chosen values.

You can use the prefix, suffix, valuePrefix, valueSuffix and delimiter options to determine how the token is formatted.

Simple XML Reference - Splunk Documentation

0 Karma

itnewbie
Explorer

@ITWhisperer Thanks for the reply. Given I use $product_brand$ in the conditional panel now, I still need to set the condition of displaying the panel. At the <condition> tag, how can I set it to accept multiple values? As the above method only accepts a single value at one time, I want it to be

if $procut_brand$ IN ANY of product brand ["A", "B", "C"], set the display panel to true

and if not in those 3, just don't display. Any nudge in the right direction? Many thanks. 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...