Splunk Search

Passing token to macro when multiselect

smanojkumar
Contributor

Hi Splunkers,
   I would like to pass the label value to the macro based on some condition, when a single value is selected, the value is correctly passed to macro and search is loading the results but when the multiple values were selected the search is throwing error in macro.

</input>
<input type="multiselect" token="machine" searchWhenChanged="true">
<label>Machine type</label>
<choice value="*">All</choice>
<choice value="VDI">VDI</choice>
<choice value="Industrial">Industrial</choice>
<choice value="Standard">Standard</choice>
<choice value="MacOS">MacOS</choice>
<choice value="**">DMZ</choice>
<default>*</default>
<initialValue>*</initialValue>
<delimiter>, </delimiter>
<change>
<condition match="$label$ == &quot;*DMZ*&quot;">
<set token="machine_type_dmz">"mcafee_DMZ=DMZ"</set>
</condition>
<condition match="$label$ != &quot;*DMZ*&quot;">
<unset token="machine_type_dmz"></unset>
</condition>
</change>
</input>



Thanks in Advance!

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @smanojkumar,

Since you are passing arguments using comma delimiter, it seems does not match the macro definition. 

Solution depends on your macro search definition,  you can update your macro search definition for using OR, you can pass multiple values delimited by  " OR " (with spaces) 

Like below;

</input>
<input type="multiselect" token="machine" searchWhenChanged="true">
<label>Machine type</label>
<choice value="*">All</choice>
<choice value="VDI">VDI</choice>
<choice value="Industrial">Industrial</choice>
<choice value="Standard">Standard</choice>
<choice value="MacOS">MacOS</choice>
<choice value="**">DMZ</choice>
<default>*</default>
<initialValue>*</initialValue>
  <prefix> (</prefix>
  <suffix> )</suffix>
  <delimiter> OR </delimiter>
<change>
<condition match="$label$ == &quot;*DMZ*&quot;">
<set token="machine_type_dmz">"mcafee_DMZ=DMZ"</set>
</condition>
<condition match="$label$ != &quot;*DMZ*&quot;">
<unset token="machine_type_dmz"></unset>
</condition>
</change>
</input>
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...