Splunk Search

Passing multiselect values to macros

smanojkumar
Contributor

Hi There!
   I would like to pass multiselect values to macros, earlier it was dropdown. The values in multiselect itself an macros which we need pass as a token to search,

<input type="checkbox" token="index_scope" searchWhenChanged="true">
<label>Choose console</label>
<choice value="1T*">Standard</choice>
<choice value="2A*">Scada</choice>
<choice value="2S*">AWS</choice>
<default>1T*</default>
<initialValue>1T*</initialValue>
</input>|

Here is the search

`compliance($index_scope$, now(), $timerange$, $scope$, $origin$, $country$, $cacp$)`

 

It's not working as expected in multiselect, earlier for dropdown its working good.

Thanks in Advance!
Manoj Kumar S

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I'm pretty sure this is the same as Passing multiselect token to the macros.  Answer is given there.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...