Splunk Search

Passing multiselect in Where clause

jonu4u
New Member

I've a multiselect.

  <label>Grade</label>
  <default>9,6,7</default>
  <fieldForLabel>grade_name</fieldForLabel>
  <fieldForValue>grade_name</fieldForValue>
  <search>
    <query/>
  </search>
  <initialValue>9,6,7</initialValue>
</input>

I want to pass these selected values in a where clause:
]
|inputlookup prod_students.csv | table school_name, school_id,grade_name |eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id| where grade_name IN ("$grade_name$")
The above query is not working. I can't move the where next to lookup as I'm doing it on the eventstats field.

0 Karma
1 Solution

manjunathmeti
Champion

Add delimiter in the input and remove double quotes around the token in search query.

...
<fieldForLabel>grade_name</fieldForLabel>
<fieldForValue>grade_name</fieldForValue>
<delimiter>,</delimiter>

Search query:

|inputlookup prod_students.csv | table school_name, school_id,grade_name |eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id| where grade_name IN ($grade_name$) 

And if grade_name is part of prod_students.csv, then query will be(which is much faster):

| inputlookup prod_students.csv where grade_name IN ($grade_name$) | table school_name, school_id,grade_name |eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id

View solution in original post

0 Karma

dmarling
Builder

Hello,

The reason why it is failing is because your token is concatenating the results together and wrapping it in quotes. You need to specify the token value prefix and suffix and delimter in your xml like this:

    <input type="multiselect" token="grade_name">
      <label>Grade</label>
      <default>9,6,7</default>
      <fieldForLabel>grade_name</fieldForLabel>
      <fieldForValue>grade_name</fieldForValue>
      <search>
        <query/>
      </search>
      <initialValue>9,6,7</initialValue>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>, </delimiter>
    </input>

You also need to remove the quotes around the token in your search so it looks like this:

| inputlookup prod_students.csv 
| table school_name, school_id,grade_name 
| eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id 
| where grade_name IN ($grade_name$)

If you do that your output will look like this in the search with the default:

| inputlookup prod_students.csv 
| table school_name, school_id,grade_name 
| eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id 
| where grade_name IN ("9","6","7")

Previously it looked like this:

| inputlookup prod_students.csv 
| table school_name, school_id,grade_name 
| eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id 
| where grade_name IN ("967")
If this comment/answer was helpful, please up vote it. Thank you.
0 Karma

manjunathmeti
Champion

Add delimiter in the input and remove double quotes around the token in search query.

...
<fieldForLabel>grade_name</fieldForLabel>
<fieldForValue>grade_name</fieldForValue>
<delimiter>,</delimiter>

Search query:

|inputlookup prod_students.csv | table school_name, school_id,grade_name |eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id| where grade_name IN ($grade_name$) 

And if grade_name is part of prod_students.csv, then query will be(which is much faster):

| inputlookup prod_students.csv where grade_name IN ($grade_name$) | table school_name, school_id,grade_name |eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...