Splunk Search

I need to create panel with filter

shruti14
Explorer

Hi,

So i have below base query :

| inputlookup abc.csv where DECOMMISSIONED=N
| fields DATABASE DB_VERSION APP_NAME ACTIVE_DC HOST_NAME DB_ROLE COMPLIANCE_FLAG PII PCI SOX
| rename DATABASE as Database | join type=left Database
[| metadata type=hosts index=data
| fields host, lastTime, totalCount
| eval Database=Upper(host)| search totalCount>1
| stats max(lastTime) as lastTime, last(totalCount) as totalCount by Database
| eval age=round((now()-lastTime)/3600,1)
| eval Status=case(
lastTime>(now()-(3600*2)),"Low",
lastTime<(now()-(3600*2+1)) AND lastTime>(now()-(3600*8)) ,"Medium",
lastTime<(now()-(3600*8+1)) AND lastTime>(now()-(3600*24)),"High",
1=1,"Critical")
| convert ctime(lastTime) timeformat="%d-%m-%Y %H:%M:%S"
| eval Reference="SPL"]
| rex mode=sed field=HOST_NAME "s/\..*$//g"
| fields Database Reference DB_VERSION APP_NAME ACTIVE_DC HOST_NAME Status DB_ROLE COMPLIANCE_FLAG
| fillnull value=Missing Status
| fillnull value=Null

Now i need to add field let say Privacy with PII PCI and SOX as filter but i don't need the value of these fields to be come as filter in Privacy filed and reflect same in summary tab 

<row>
<panel>
<table>
<title>Summary</title>
<search base="base">
<query>| search APP_NAME="$application$" Database="$database$" HOST_NAME="$host$" DB_VERSION="$version$" Status="$status$" COMPLIANCE_FLAG="$compliance$" Privacy="$privacyFilter$"
| eval StatusSort=case(Status="Missing","1",Status="Critical","2",Status="High","3",Status="Medium","4",Status="Low","5")
| sort StatusSort
| table APP_NAME Database HOST_NAME DB_VERSION ACTIVE_DC Status DB_ROLE COMPLIANCE_FLAG PII PCI SOX
| rename APP_NAME as Application, DB_VERSION as Version, ACTIVE_DC as DC, HOST_NAME as HOST</query>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="number" field="FileSize">
<option name="precision">0</option>
</format>
<format type="color" field="Status">
<colorPalette type="map">{"Missing":#DC4E41,"Critical":#F1813F,"High":#F8BE34,"Medium":#62B3B2,"Low":#53A051}</colorPalette>
</format>
</table>
</panel>
</row>
</form>

 

can someone help how i can get i added this panel

<!-- New Privacy Filter Panel -->
<input type="multiselect" token="privacyFilter" searchWhenChanged="true">
<label>Privacy</label>
<choice value="*">All</choice>
<choice value="PII">PII</choice>
<choice value="PCI">PCI</choice>
<choice value="SOX">SOX</choice>
<fieldForLabel>Privacy</fieldForLabel>
<fieldForValue>Privacy</fieldForValue>
<default>*</default>
<initialValue>*</initialValue>
</input>
</fieldset>

and this

 <row>
<panel>
<table>
<title>Summary</title>
<search base="base">
<query>| search APP_NAME="$application$" Database="$database$" HOST_NAME="$host$" DB_VERSION="$version$" Status="$status$" COMPLIANCE_FLAG="$compliance$" Privacy="$privacyFilter$"
| eval StatusSort=case(Status="Missing","1",Status="Critical","2",Status="High","3",Status="Medium","4",Status="Low","5")
| sort StatusSort
| table APP_NAME Database HOST_NAME DB_VERSION ACTIVE_DC Status DB_ROLE COMPLIANCE_FLAG PII PCI SOX
| rename APP_NAME as Application, DB_VERSION as Version, ACTIVE_DC as DC, HOST_NAME as HOST</query>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="number" field="FileSize">
<option name="precision">0</option>
</format>
<format type="color" field="Status">
<colorPalette type="map">{"Missing":#DC4E41,"Critical":#F1813F,"High":#F8BE34,"Medium":#62B3B2,"Low":#53A051}</colorPalette>
</format>
</table>
</panel>
</row>
</form>

 

but getting no result found 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It doesn't make sense to use an equality operator with a multi-select token.  Try the IN operator.

... Privacy IN ($privacyFilter$) ...

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...