Dashboards & Visualizations

splunk xml multiselect - set token

pjac1029
Explorer

I created a  dashboard with an input  that allows the user to select a user field from a dropdown that's populated by a lookup table.  I need to use a multiselect input type to allo users to filter for one user or all users.

I created a change form  to prefix the selected user with "production\"
and run a query In the  panel that retrieves firewall events  where the user = the new token value (prefixed with "production\") since the user in the firewall index is prefixed with "production".

the issue is that the set token  runs whenever i change the value in the multiselect and appends "production\" to the token value multiple times

Is there a way to set the token AFTER the user has set the filter? also how do I filter for ALL events (when the user select ALL in the multiselect input? below is my XML code.

Thanks in advance.

<dashboard version="1.1" theme="light">
<label>new firewall</label>

<row>
<panel>
<title> Request Information</title>
<input type="multiselect" token="webuser" searchWhenChanged="true">
<label>User</label>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
<delimiter> </delimiter>
<fieldForLabel>UserName</fieldForLabel>
<fieldForValue>UserName</fieldForValue>
<search>
<query>| inputlookup my_users.csv
| dedup UserName
| table UserName</query>
</search>
<change>
<set token="webuser">prod\\$webuser$</set>
</change>

</input>
<input type="time" token="webtime" searchWhenChanged="true">
<label></label>
<default>
<earliest>-4h@m</earliest>
<latest>now</latest>
</default>
</input>
<table>
<search>
<query>( index = main sourcetype = firewall ) action=blocked | search
[ inputlookup my_users.csv
| eval userName = "prod\\".UserName
| rename userName as user
| table user ]

|table _time, $webuser$ index, action
|search user=$webuser$</query>
<earliest>$webtime.earliest$</earliest>
<latest>$webtime.latest$</latest>
</search>
<option name="drilldown">cell</option>
</table>
</panel>
</row>
</dashboard>

 

 

 

Labels (3)
0 Karma

pjac1029
Explorer

thanks for your help. i incorporated the logic to handle "all" and the user prefix.. worked great.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

To handle an 'All' static option in the multiselect, add this change element

        <change>
          <condition match="$form.webuser=&quot;*&quot;">
            <set token="webuser"></set>
          </condition>
          <condition>
            <eval token="form.webuser">case(mvcount($form.webuser$)="2" AND mvindex($form.webuser$,0)="*", mvindex($form.webuser$,1), mvfind($form.webuser$,"^\\*$$")=mvcount($form.webuser$)-1, "*", true(), $form.webuser$)</eval>
          </condition>
        </change>
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Note that this means when you select "All" it removes the other options if selected and vice versa, if you have All selected and choose one of the other options, it removes "All" from the list of selections.

0 Karma

livehybrid
Super Champion

Hi @pjac1029 

You should use valuePrefix for this:

<valuePrefix>"production\</valuePrefix>

livehybrid_0-1745877506347.png

 

You may also need to change some other fields, including your search, so that you get the *OR* element, I opted for a "WHERE x IN (list)" in the above example.

I used:

      <valuePrefix>"production\</valuePrefix>
      <prefix>user IN (</prefix>
      <suffix>)</suffix>
      <valueSuffix>"</valueSuffix>
      <delimiter>,  </delimiter>

 

Below is a full working example dashboard:

<form version="1.1">
  <label>Answers production prefix</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="user" searchWhenChanged="true">
      <label>Username</label>
      <fieldForLabel>username</fieldForLabel>
      <fieldForValue>username</fieldForValue>
      <search>
        <query>| makeresults | eval username="Test1" | append [|makeresults | eval username="Test2"] | table username</query>
      </search>
      <valuePrefix>"production\</valuePrefix>
      <prefix>user IN (</prefix>
      <suffix>)</suffix>
      <valueSuffix>"</valueSuffix>
      <delimiter>,  </delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults 
| eval user="production\Test1", action="Action1"
| append [| makeresults | eval user="production\Test2", action="Action2"]
| append [| makeresults | eval user="production\Test3", action="Action3"]
| where $user$</query>
          <earliest>@h</earliest>
          <latest>now</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...