Dashboards & Visualizations

Multiselect input filter using case statement

gemrose
Explorer

Hello Team,

I am trying for a solution using multiselect input filter where the index token is passed to panels.

From the below code, I currently see the filter values "Stack1", "Stack2" and "Stack3". But I face an issue that the value passed is from label. I need the index_tkn to hold value aws_stack02_p, aws_stack01_p, aws_stack01`_n.

<input type="multiselect" token="index_tkn" searchWhenChanged="false">
<label>Select Stack</label>
<valuePrefix>index="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>index</fieldForLabel>
<fieldForValue>label</fieldForValue>
<search>
<query>index IN ({aws_stack02_p,aws_stack01_p,aws_stack01_n})
| eval label = case(index == "aws_stack02_p", "Stack1",index == "aws_stack01_p", "Stack2",index == "aws_stack01_n", "Stack3")
|stats count by label</query>
<earliest>$time_tkn.earliest$</earliest>
<latest>$time_tkn.latest$</latest>
</search>
</input>

 

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Since you appear to have a one-to-one relationship between label and index, just include both in the by clause

<query>index IN ({aws_stack02_p,aws_stack01_p,aws_stack01_n})
| eval label = case(index == "aws_stack02_p", "Stack1",index == "aws_stack01_p", "Stack2",index == "aws_stack01_n", "Stack3")
|stats count by label,index</query>
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...