Splunk Search

Passing multiselect in Where clause

jonu4u
New Member

I've a multiselect.

  <label>Grade</label>
  <default>9,6,7</default>
  <fieldForLabel>grade_name</fieldForLabel>
  <fieldForValue>grade_name</fieldForValue>
  <search>
    <query/>
  </search>
  <initialValue>9,6,7</initialValue>
</input>

I want to pass these selected values in a where clause:
]
|inputlookup prod_students.csv | table school_name, school_id,grade_name |eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id| where grade_name IN ("$grade_name$")
The above query is not working. I can't move the where next to lookup as I'm doing it on the eventstats field.

0 Karma
1 Solution

manjunathmeti
Champion

Add delimiter in the input and remove double quotes around the token in search query.

...
<fieldForLabel>grade_name</fieldForLabel>
<fieldForValue>grade_name</fieldForValue>
<delimiter>,</delimiter>

Search query:

|inputlookup prod_students.csv | table school_name, school_id,grade_name |eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id| where grade_name IN ($grade_name$) 

And if grade_name is part of prod_students.csv, then query will be(which is much faster):

| inputlookup prod_students.csv where grade_name IN ($grade_name$) | table school_name, school_id,grade_name |eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id

View solution in original post

0 Karma

dmarling
Builder

Hello,

The reason why it is failing is because your token is concatenating the results together and wrapping it in quotes. You need to specify the token value prefix and suffix and delimter in your xml like this:

    <input type="multiselect" token="grade_name">
      <label>Grade</label>
      <default>9,6,7</default>
      <fieldForLabel>grade_name</fieldForLabel>
      <fieldForValue>grade_name</fieldForValue>
      <search>
        <query/>
      </search>
      <initialValue>9,6,7</initialValue>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>, </delimiter>
    </input>

You also need to remove the quotes around the token in your search so it looks like this:

| inputlookup prod_students.csv 
| table school_name, school_id,grade_name 
| eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id 
| where grade_name IN ($grade_name$)

If you do that your output will look like this in the search with the default:

| inputlookup prod_students.csv 
| table school_name, school_id,grade_name 
| eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id 
| where grade_name IN ("9","6","7")

Previously it looked like this:

| inputlookup prod_students.csv 
| table school_name, school_id,grade_name 
| eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id 
| where grade_name IN ("967")
If this comment/answer was helpful, please up vote it. Thank you.
0 Karma

manjunathmeti
Champion

Add delimiter in the input and remove double quotes around the token in search query.

...
<fieldForLabel>grade_name</fieldForLabel>
<fieldForValue>grade_name</fieldForValue>
<delimiter>,</delimiter>

Search query:

|inputlookup prod_students.csv | table school_name, school_id,grade_name |eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id| where grade_name IN ($grade_name$) 

And if grade_name is part of prod_students.csv, then query will be(which is much faster):

| inputlookup prod_students.csv where grade_name IN ($grade_name$) | table school_name, school_id,grade_name |eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...