Splunk Search

Passing multiselect values to macros

smanojkumar
Contributor

Hi There!
   I would like to pass multiselect values to macros, earlier it was dropdown. The values in multiselect itself an macros which we need pass as a token to search,

<input type="checkbox" token="index_scope" searchWhenChanged="true">
<label>Choose console</label>
<choice value="1T*">Standard</choice>
<choice value="2A*">Scada</choice>
<choice value="2S*">AWS</choice>
<default>1T*</default>
<initialValue>1T*</initialValue>
</input>|

Here is the search

`compliance($index_scope$, now(), $timerange$, $scope$, $origin$, $country$, $cacp$)`

 

It's not working as expected in multiselect, earlier for dropdown its working good.

Thanks in Advance!
Manoj Kumar S

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I'm pretty sure this is the same as Passing multiselect token to the macros.  Answer is given there.

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...