Splunk Search

Issues in multiselect input dropdown

smanojkumar
Contributor

Hello There,
   I'm hvaing issues in multiselect input dropdown

<input type="multiselect" token="siteid" searchWhenChanged="true">
<label>Site</label>
<choice value="*">All</choice>
<choice value="03">No Site Selected</choice>
<fieldForLabel>displayname</fieldForLabel>
<fieldForValue>prefix</fieldForValue>
<search>
<query>
| inputlookup site_ids.csv
| search displayname != "ABN8" AND displayname != "ABR8" AND displayname != "ABRA7" AND displayname != "ABMAN2"
</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<delimiter>_fc7 OR index=</delimiter>
<suffix>_fc7</suffix>
<default>03</default>
<initialValue>03</initialValue>
<change>
<eval token="form.siteid">case(mvcount('form.siteid') == 2 AND mvindex('form.siteid', 0) == "03", mvindex('form.siteid', 1), mvfind('form.siteid', "\\*") == mvcount('form.siteid') - 1, "03", true(), 'form.siteid')</eval>
</change>
</input>

<input type="multiselect" token="system_number" searchWhenChanged="true">
<label>Node</label>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>Node</fieldForLabel>
<fieldForValue>sys_number</fieldForValue>
<change>
<eval token="form.system_number">case(mvcount('form.system_number') == 2 AND mvindex('form.system_number', 0) == "*", mvindex('form.system_number', 1), mvfind('form.system_number', "\\*") == mvcount('form.system,_number') - 1, "*", true(), 'form.system_number')</eval>
</change>
<search>
<query>| inputlookup  node.csv
| fields site prefix Node sys_number
| eval token_value = "$siteid$"
| eval site_val = if(match(token_value, "OR\s*index="), split(replace(token_value, "\s*OR\s*index=\s*", ","), ","), token_value)
| where prefix=site_val
| dedup Node
| table Node sys_number</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<prefix>"</prefix>
<suffix>"</suffix>
<valueSuffix>","</valueSuffix>
<delimiter> </delimiter>
</input>


the problem here is, I need to have field for label as Node but , When I'm selecting an value in siteid, then selecting a value in Node, after that selecting the secong value in Siteid, the node change its value to sys_number, but actually it should be Node, as we mentioned fields label as Node only but it changes to sys_number.
   this only happens after selecting any values in Node, if we select values in siteid, the Node behaved wierd. Other eise its fine,

Thanks!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...