Splunk Search

Passing Multiselect macro input token to search

smanojkumar
Contributor

Hi Splunkers!
  I would like to pass two macros as a token to a base search when multiple values in multiselect is selected,

<done>
<condition match="$index$ == &quot;2A*&quot; AND $index$ == &quot;1T*&quot; AND $index$ == &quot;2S*&quot;">
<set token="standard">true</set>
<set token="scada">true</set>
<set token="aws">true</set>
<set token="index_label">Standard, Scada, AWS</set>
<set token="index_scope">`scada` OR `aws` OR `standard($cmdb_scope$)`</set>
</condition>
<condition match="$index$ == &quot;2A*&quot; AND $index$ == &quot;1T*&quot;">
<set token="standard">true</set>
<unset token="aws"></unset>
<set token="scada">true</set>
<set token="index_label"> Standard,  Scada</set>
<set token="index_scope">`scada` OR `standard($cmdb_scope$)`</set>
</condition>
<condition match="$index$ == &quot;2A*&quot; AND $index$ == &quot;2S*&quot;">
<unset token="standard"></unset>
<set token="scada">true</set>
<set token="aws">true</set>
<set token="index_label"> Scada,  AWS</set>
<set token="index_scope">`scada` OR `aws`</set>
</condition>
<condition match="$index$ == &quot;2S*&quot; AND $index$ == &quot;1T*&quot;">
<set token="standard">true</set>
<unset token="scada"></unset>
<set token="aws">true</set>
<set token="index_label"> AWS,  Standard</set>
<set token="index_scope">`aws` OR `standard($cmdb_scope$)`</set>
</condition>
<condition match="$index$ == &quot;2A*&quot;">
<unset token="standard"></unset>
<set token="scada">true</set>
<unset token="aws"></unset>
<set token="index_label"> Scada</set>
<set token="index_scope">`scada`</set>
</condition>
<condition match="$index$ == &quot;2S*&quot;">
<unset token="standard"></unset>
<unset token="scada"></unset>
<set token="aws">true</set>
<set token="index_label"> AWS</set>
<set token="index_scope">`aws`</set>
</condition>
<condition match="$index$ == &quot;1T*&quot;">
<set token="standard">true</set>
<unset token="scada"></unset>
<unset token="aws"></unset>
<set token="index_label"> Standard</set>
<set token="index_scope"> `standard($cmdb_scope$)`</set>
</condition>

    <input type="checkbox" token="index" searchWhenChanged="true">

      <label>Choose  console</label>

      <choice value="1T*"> Standard</choice>

      <choice value="2A*"> Scada</choice>

      <choice value="2S*"> AWS</choice>

      <default>1T*, 2A*,2S* </default>

      <initialValue>1T*, 2A*,2S* </initialValue>

      <change>

        <set token="index_label">$label$</set>

      </change>

      <change>

        <condition match="$index$ == &quot;1T*&quot; AND $index$ == &quot;2A*&quot; AND $index$ == &quot;2S*&quot;">

          <set token="standard">true</set>

          <set token="scada">true</set>

          <set token="aws">true</set>

          <set token="index_scope">`scada` OR `standard($cmdb_scope$)` OR `aws`</set>

        </condition>

        <condition match="$index$ == &quot;1T*&quot; AND $index$ == &quot;2A*&quot;">

          <set token="standard">true</set>

          <set token="scada">true</set>

          <unset token="aws"></unset>

          <set token="index_scope">`scada` OR `standard($cmdb_scope$)`</set>

        </condition>

        <condition match="$index$ == &quot;2A*&quot; AND $index$ == &quot;2S*&quot;">

          <unset token="standard"></unset>

          <set token="scada">true</set>

          <set token="aws">true</set>

          <set token="index_scope">`scada` OR `aws`</set>

        </condition>

        <condition match="$index$ == &quot;2S*&quot; AND $index$ == &quot;1T*&quot;">

          <set token="standard">true</set>

          <unset token="scada"></unset>

          <set token="aws">true</set>

          <set token="index_scope">`aws` OR `standard($cmdb_scope$)`</set>

        </condition>

        <condition match="$index$ == &quot;2A*&quot;">

          <unset token="standard"></unset>

          <set token="scada">true</set>

          <unset token="aws"></unset>

          <set token="index_scope">`scada`</set>

        </condition>

        <condition match="$index$ == &quot;2S*&quot;">

          <unset token="standard"></unset>

          <unset token="scada"></unset>

          <set token="aws">true</set>

          <set token="index_scope">`aws`</set>

        </condition>

        <condition match="$index$ == &quot;1T*&quot;">

          <set token="standard">true</set>

          <unset token="scada"></unset>

          <unset token="aws"></unset>

          <set token="index_scope">`standard($cmdb_scope$)`</set>

        </condition>

       but this is not working, Only one value is  passed when selecting two values.

Thanks!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...