Splunk Search

Passing multiselect in Where clause

jonu4u
New Member

I've a multiselect.

  <label>Grade</label>
  <default>9,6,7</default>
  <fieldForLabel>grade_name</fieldForLabel>
  <fieldForValue>grade_name</fieldForValue>
  <search>
    <query/>
  </search>
  <initialValue>9,6,7</initialValue>
</input>

I want to pass these selected values in a where clause:
]
|inputlookup prod_students.csv | table school_name, school_id,grade_name |eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id| where grade_name IN ("$grade_name$")
The above query is not working. I can't move the where next to lookup as I'm doing it on the eventstats field.

0 Karma
1 Solution

manjunathmeti
Champion

Add delimiter in the input and remove double quotes around the token in search query.

...
<fieldForLabel>grade_name</fieldForLabel>
<fieldForValue>grade_name</fieldForValue>
<delimiter>,</delimiter>

Search query:

|inputlookup prod_students.csv | table school_name, school_id,grade_name |eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id| where grade_name IN ($grade_name$) 

And if grade_name is part of prod_students.csv, then query will be(which is much faster):

| inputlookup prod_students.csv where grade_name IN ($grade_name$) | table school_name, school_id,grade_name |eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id

View solution in original post

0 Karma

dmarling
Builder

Hello,

The reason why it is failing is because your token is concatenating the results together and wrapping it in quotes. You need to specify the token value prefix and suffix and delimter in your xml like this:

    <input type="multiselect" token="grade_name">
      <label>Grade</label>
      <default>9,6,7</default>
      <fieldForLabel>grade_name</fieldForLabel>
      <fieldForValue>grade_name</fieldForValue>
      <search>
        <query/>
      </search>
      <initialValue>9,6,7</initialValue>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>, </delimiter>
    </input>

You also need to remove the quotes around the token in your search so it looks like this:

| inputlookup prod_students.csv 
| table school_name, school_id,grade_name 
| eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id 
| where grade_name IN ($grade_name$)

If you do that your output will look like this in the search with the default:

| inputlookup prod_students.csv 
| table school_name, school_id,grade_name 
| eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id 
| where grade_name IN ("9","6","7")

Previously it looked like this:

| inputlookup prod_students.csv 
| table school_name, school_id,grade_name 
| eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id 
| where grade_name IN ("967")
If this comment/answer was helpful, please up vote it. Thank you.
0 Karma

manjunathmeti
Champion

Add delimiter in the input and remove double quotes around the token in search query.

...
<fieldForLabel>grade_name</fieldForLabel>
<fieldForValue>grade_name</fieldForValue>
<delimiter>,</delimiter>

Search query:

|inputlookup prod_students.csv | table school_name, school_id,grade_name |eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id| where grade_name IN ($grade_name$) 

And if grade_name is part of prod_students.csv, then query will be(which is much faster):

| inputlookup prod_students.csv where grade_name IN ($grade_name$) | table school_name, school_id,grade_name |eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...