Reporting

How to select multiple values in a checkbox for a saved search?

qxu5715
Explorer

I want to build a Dashbaord with a savedsearch and a checkbox input with several values (value1,value2,value3...)

When I am selecting just one value on the UI, the search works fine, but as soon as I'm selecting several values, it is not working anymore. To be honest I am not sure if the reason is my wrong search query or my wrong use of tokens:

<input type="checkbox" token="Token_name" searchWhenChanged="true">
      <label>field1</label>
      <choice value="value1">value1</choice>
      <choice value="value2">value2</choice>
      <choice value="value3">value3</choice>
      <delimiter> OR </delimiter>

<search>
 <query>|savedsearch "saved_Report" |search Value_in_report=$Token_name$</query>
  </search>

I've tried several options of changing the token properties including:

Token Prefix -> (
Token Suffix -> )
Token Value Prefix -> Value_in_report="
Token Value Suffix -> "
Delimiter -> AND,OR

It would be nice, if sb. could explain how the checkbox input is working with several selected values.

Thanks and regards

0 Karma
1 Solution

DalJeanis
Legend

Your later sample should have worked. The only change necessary would seem to be...

|search $Token_name$

One way to debug this would be to add an html display to a panel so that you can see exactly what is being loaded into the checkbox's value. Then open a search screen and paste that into the search where the $Token_name$ is.

View solution in original post

harish_l
New Member

can you please help to select the multiple value, like i need to filter 2 or 3 values out of 6.

This is my search :
|inputlookup target_lookup
| where targetType LIKE("$value$")
| makemv delim="," targetType
|table targetType

Saved search :
| savedsearch filter $value$

Its not working for me. could you please help me to resolve.

0 Karma

DalJeanis
Legend

Your later sample should have worked. The only change necessary would seem to be...

|search $Token_name$

One way to debug this would be to add an html display to a panel so that you can see exactly what is being loaded into the checkbox's value. Then open a search screen and paste that into the search where the $Token_name$ is.

qxu5715
Explorer

Worked well, thanks for the support!

harish_l
New Member

can you please help to select the multiple value, like i need to filter 2 or 3 values out of 6.

This is my search :
|inputlookup target_lookup
| where targetType LIKE("$value$")
| makemv delim="," targetType
|table targetType

Saved search :
| savedsearch filter $value$

Its not working for me. could you please help me to resolve.

0 Karma
Get Updates on the Splunk Community!

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...

Join Us at the Builder Bar at .conf24 – Empowering Innovation and Collaboration

What is the Builder Bar? The Builder Bar is more than just a place; it's a hub of creativity, collaboration, ...

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...