How to display multi select value on the title of a panel

[RRajneesh]

Hello,

I want only the value of my multi select to appear on the title of the panel. But actually, both the technical field name along with the value is getting displayed.

Can you please help ?

Thanks.

King Regards,
Rajneesh.

[mayurr98]

Try this run anywhere XML

<form>
  <label>Sample Multiselect panel title</label>
  <fieldset>
    <input type="multiselect" token="log_level">
      <label>log_level</label>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>log_level</fieldForLabel>
      <fieldForValue>log_level</fieldForValue>
      <search>
        <query>index=_internal 
|  dedup log_level 
|  table log_level</query>
        <earliest>@d</earliest>
        <latest>now</latest>
      </search>
      <delimiter>,</delimiter>
    </input>
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Entrée/Sortie/Backlog - $log_level$</title>
        <search>
          <query>index=_internal log_level IN ($log_level$)</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
        <option name="charting.axisTitleX.text">Semaine</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.text">Ticket</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisY2.enabled">1</option>
        <option name="charting.axisY2.scale">log</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.columnSpacing">10</option>
        <option name="charting.chart.overlayFields">Backlog</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.fieldColors">{"Entrée": 0xFF0000, "Sortie": #008000 , "Backlog":0x0066FF}</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
      </chart>
    </panel>
  </row>
</form>

You would need to do some changes in search query and multiselect filter XML.
your multiselect should be

<input type="multiselect" token="problem_mapping">
      <label>log_level</label>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>problem_mapping</fieldForLabel>
      <fieldForValue>problem_mapping</fieldForValue>
      <search>
     <query>sourcetype=aiam_itsm_ticket_stesofiproteo1 | dedup problem_mapping | table problem_mapping | sort problem_mapping</query>
     <earliest>0</earliest>
     <latest></latest>
   </search>
      <delimiter>,</delimiter>
    </input>

and in panel your search query should be something like this

problem_mapping  IN ($problem_mapping$)

which is equivalent to problem_mapping=value1 OR problem_mapping=value2 OR problem_mapping=value3 and so on..

[DalJeanis]

Note - for posterity's sake, you should probably note what Splunk release this is valid on.

IIRC, I believe the IN syntax became available in 6.6.

For 6.5 and below, you'd use something like this...

   <label>log_level</label>
   <choice value="*">All</choice>
   <default>*</default>
   <initialValue>*</initialValue>
   <fieldForLabel>log_level</fieldForLabel>
   <fieldForValue>log_level</fieldForValue>
   <search>
     <query>index=_internal
         | stats count by log_level 
         | table log_level
     </query>
     <earliest>@d</earliest>
     <latest>now</latest>
   </search>    

   <prefix>(</prefix>
   <valuePrefix>log_level="</valuePrefix>
   <valueSuffix>"</valueSuffix>
   <delimiter> OR </delimiter>
   <suffix>)</suffix>

And the query would have this...

     <query>index=_internal  $log_level$</query>

[mayurr98]

It would be better if you post the XML and expected output for your code.

[RRajneesh]

Hi,

My multiselect :

  <label>Avril / TMA</label>
  <choice value="*">All</choice>
  <default>*</default>
  <initialValue>*</initialValue>
  <fieldForLabel>problem_mapping</fieldForLabel>
  <fieldForValue>problem_mapping</fieldForValue>
  <search>
    <query>sourcetype=aiam_itsm_ticket_stesofiproteo1 | dedup problem_mapping | table problem_mapping | sort problem_mapping</query>
    <earliest>0</earliest>
    <latest></latest>
  </search>
  <delimiter> OR </delimiter>
  <prefix>(</prefix>
  <valuePrefix>problem_mapping="</valuePrefix>
  <valueSuffix>"</valueSuffix>
  <suffix>)</suffix>
</input>

My panel :

<panel>
  <chart>
    <title>Entrée/Sortie/Backlog - $problem_mapping$ </title>
    <search>
      <query>* I HAVE MY QUERY HERE*</query>
      <earliest>$time.earliest$</earliest>
      <latest>$time.latest$</latest>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
    <option name="charting.axisTitleX.text">Semaine</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Ticket</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisY2.enabled">1</option>
    <option name="charting.axisY2.scale">log</option>
    <option name="charting.chart">column</option>
    <option name="charting.chart.overlayFields">Backlog</option>
    <option name="charting.chart.showDataLabels">all</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.drilldown">none</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.placement">bottom</option>
    <option name="charting.fieldColors">
      {"Entrée": 0xFF0000, "Sortie": #008000 , "Backlog":0x0066FF}
    </option>
    <option name="charting.chart.columnSpacing">10</option>
    <option name="trellis.enabled">0</option>
  </chart>
</panel>

Thanks.