Dashboards & Visualizations

splunk xml multiselect - set token

pjac1029
Explorer

I created a  dashboard with an input  that allows the user to select a user field from a dropdown that's populated by a lookup table.  I need to use a multiselect input type to allo users to filter for one user or all users.

I created a change form  to prefix the selected user with "production\"
and run a query In the  panel that retrieves firewall events  where the user = the new token value (prefixed with "production\") since the user in the firewall index is prefixed with "production".

the issue is that the set token  runs whenever i change the value in the multiselect and appends "production\" to the token value multiple times

Is there a way to set the token AFTER the user has set the filter? also how do I filter for ALL events (when the user select ALL in the multiselect input? below is my XML code.

Thanks in advance.

<dashboard version="1.1" theme="light">
<label>new firewall</label>

<row>
<panel>
<title> Request Information</title>
<input type="multiselect" token="webuser" searchWhenChanged="true">
<label>User</label>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
<delimiter> </delimiter>
<fieldForLabel>UserName</fieldForLabel>
<fieldForValue>UserName</fieldForValue>
<search>
<query>| inputlookup my_users.csv
| dedup UserName
| table UserName</query>
</search>
<change>
<set token="webuser">prod\\$webuser$</set>
</change>

</input>
<input type="time" token="webtime" searchWhenChanged="true">
<label></label>
<default>
<earliest>-4h@m</earliest>
<latest>now</latest>
</default>
</input>
<table>
<search>
<query>( index = main sourcetype = firewall ) action=blocked | search
[ inputlookup my_users.csv
| eval userName = "prod\\".UserName
| rename userName as user
| table user ]

|table _time, $webuser$ index, action
|search user=$webuser$</query>
<earliest>$webtime.earliest$</earliest>
<latest>$webtime.latest$</latest>
</search>
<option name="drilldown">cell</option>
</table>
</panel>
</row>
</dashboard>

 

 

 

Labels (3)
0 Karma

pjac1029
Explorer

thanks for your help. i incorporated the logic to handle "all" and the user prefix.. worked great.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

To handle an 'All' static option in the multiselect, add this change element

        <change>
          <condition match="$form.webuser=&quot;*&quot;">
            <set token="webuser"></set>
          </condition>
          <condition>
            <eval token="form.webuser">case(mvcount($form.webuser$)="2" AND mvindex($form.webuser$,0)="*", mvindex($form.webuser$,1), mvfind($form.webuser$,"^\\*$$")=mvcount($form.webuser$)-1, "*", true(), $form.webuser$)</eval>
          </condition>
        </change>
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Note that this means when you select "All" it removes the other options if selected and vice versa, if you have All selected and choose one of the other options, it removes "All" from the list of selections.

0 Karma

livehybrid
Super Champion

Hi @pjac1029 

You should use valuePrefix for this:

<valuePrefix>"production\</valuePrefix>

livehybrid_0-1745877506347.png

 

You may also need to change some other fields, including your search, so that you get the *OR* element, I opted for a "WHERE x IN (list)" in the above example.

I used:

      <valuePrefix>"production\</valuePrefix>
      <prefix>user IN (</prefix>
      <suffix>)</suffix>
      <valueSuffix>"</valueSuffix>
      <delimiter>,  </delimiter>

 

Below is a full working example dashboard:

<form version="1.1">
  <label>Answers production prefix</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="user" searchWhenChanged="true">
      <label>Username</label>
      <fieldForLabel>username</fieldForLabel>
      <fieldForValue>username</fieldForValue>
      <search>
        <query>| makeresults | eval username="Test1" | append [|makeresults | eval username="Test2"] | table username</query>
      </search>
      <valuePrefix>"production\</valuePrefix>
      <prefix>user IN (</prefix>
      <suffix>)</suffix>
      <valueSuffix>"</valueSuffix>
      <delimiter>,  </delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults 
| eval user="production\Test1", action="Action1"
| append [| makeresults | eval user="production\Test2", action="Action2"]
| append [| makeresults | eval user="production\Test3", action="Action3"]
| where $user$</query>
          <earliest>@h</earliest>
          <latest>now</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...