Splunk Search

I need to create panel with filter

shruti14
Explorer

Hi,

So i have below base query :

| inputlookup abc.csv where DECOMMISSIONED=N
| fields DATABASE DB_VERSION APP_NAME ACTIVE_DC HOST_NAME DB_ROLE COMPLIANCE_FLAG PII PCI SOX
| rename DATABASE as Database | join type=left Database
[| metadata type=hosts index=data
| fields host, lastTime, totalCount
| eval Database=Upper(host)| search totalCount>1
| stats max(lastTime) as lastTime, last(totalCount) as totalCount by Database
| eval age=round((now()-lastTime)/3600,1)
| eval Status=case(
lastTime>(now()-(3600*2)),"Low",
lastTime<(now()-(3600*2+1)) AND lastTime>(now()-(3600*8)) ,"Medium",
lastTime<(now()-(3600*8+1)) AND lastTime>(now()-(3600*24)),"High",
1=1,"Critical")
| convert ctime(lastTime) timeformat="%d-%m-%Y %H:%M:%S"
| eval Reference="SPL"]
| rex mode=sed field=HOST_NAME "s/\..*$//g"
| fields Database Reference DB_VERSION APP_NAME ACTIVE_DC HOST_NAME Status DB_ROLE COMPLIANCE_FLAG
| fillnull value=Missing Status
| fillnull value=Null

Now i need to add field let say Privacy with PII PCI and SOX as filter but i don't need the value of these fields to be come as filter in Privacy filed and reflect same in summary tab 

<row>
<panel>
<table>
<title>Summary</title>
<search base="base">
<query>| search APP_NAME="$application$" Database="$database$" HOST_NAME="$host$" DB_VERSION="$version$" Status="$status$" COMPLIANCE_FLAG="$compliance$" Privacy="$privacyFilter$"
| eval StatusSort=case(Status="Missing","1",Status="Critical","2",Status="High","3",Status="Medium","4",Status="Low","5")
| sort StatusSort
| table APP_NAME Database HOST_NAME DB_VERSION ACTIVE_DC Status DB_ROLE COMPLIANCE_FLAG PII PCI SOX
| rename APP_NAME as Application, DB_VERSION as Version, ACTIVE_DC as DC, HOST_NAME as HOST</query>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="number" field="FileSize">
<option name="precision">0</option>
</format>
<format type="color" field="Status">
<colorPalette type="map">{"Missing":#DC4E41,"Critical":#F1813F,"High":#F8BE34,"Medium":#62B3B2,"Low":#53A051}</colorPalette>
</format>
</table>
</panel>
</row>
</form>

 

can someone help how i can get i added this panel

<!-- New Privacy Filter Panel -->
<input type="multiselect" token="privacyFilter" searchWhenChanged="true">
<label>Privacy</label>
<choice value="*">All</choice>
<choice value="PII">PII</choice>
<choice value="PCI">PCI</choice>
<choice value="SOX">SOX</choice>
<fieldForLabel>Privacy</fieldForLabel>
<fieldForValue>Privacy</fieldForValue>
<default>*</default>
<initialValue>*</initialValue>
</input>
</fieldset>

and this

 <row>
<panel>
<table>
<title>Summary</title>
<search base="base">
<query>| search APP_NAME="$application$" Database="$database$" HOST_NAME="$host$" DB_VERSION="$version$" Status="$status$" COMPLIANCE_FLAG="$compliance$" Privacy="$privacyFilter$"
| eval StatusSort=case(Status="Missing","1",Status="Critical","2",Status="High","3",Status="Medium","4",Status="Low","5")
| sort StatusSort
| table APP_NAME Database HOST_NAME DB_VERSION ACTIVE_DC Status DB_ROLE COMPLIANCE_FLAG PII PCI SOX
| rename APP_NAME as Application, DB_VERSION as Version, ACTIVE_DC as DC, HOST_NAME as HOST</query>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="number" field="FileSize">
<option name="precision">0</option>
</format>
<format type="color" field="Status">
<colorPalette type="map">{"Missing":#DC4E41,"Critical":#F1813F,"High":#F8BE34,"Medium":#62B3B2,"Low":#53A051}</colorPalette>
</format>
</table>
</panel>
</row>
</form>

 

but getting no result found 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It doesn't make sense to use an equality operator with a multi-select token.  Try the IN operator.

... Privacy IN ($privacyFilter$) ...

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...