I have a dashboard that uses a search-powered multiselect for user to filter out result, the source code looks like this:
<input type="multiselect" token="emaiLtype" searchWhenChanged="true">
<label>Select one or many email type(s):</label>
<search>
<query>index=applogsprd module=communication | stats count by email_type</query>
</search>
<default>*</default>
<fieldForLabel>email_type</fieldForLabel>
<fieldForValue>email_type</fieldForValue>
<valuePrefix>emaiL_type=</valuePrefix>
<valueSuffix></valueSuffix>
<delimiter> OR </delimiter>
</input>
<chart>
<search>
<query>index=applogsprd sourcetype=advisor:domain module=communication $emailtype$ | stats count(eval(can_send_email="true" and application="monolith")) AS CAN_SEND_MONO, count(eval(can_send_email="true" and application="microservice")) AS CAN_SEND_MS, count(eval(can_send_email="false" and application="monolith")) AS CANNOT_SEND_MONO, count(eval(can_send_email="false" and application="microservice")) AS CANNOT_SEND_MS by email_type</query>
<earliest>1510387200</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
However, when the dashboard is up, regardless what value user selected in multiselect, it keeps showing "Search is waiting for input..."
I have another dashboard constructed exactly the same way, and that one works. Any idea that what might go wrong?
Your token definition is token="emaiLtype"
"emaiLtype" with "L" and the token substitution is index=applogsprd sourcetype=advisor:domain module=communication $emailtype$
with "l". Not sure if it's a typo but just try changing it
Hi
Can you please update input XML and try again?
<input type="multiselect" token="emailtype" searchWhenChanged="true">
<label>Select one or many email type(s):</label>
<search>
<query>index=applogsprd module=communication | stats count by email_type</query>
</search>
<default>*</default>
<fieldForLabel>email_type</fieldForLabel>
<fieldForValue>email_type</fieldForValue>
<valuePrefix>emaiL_type=</valuePrefix>
<valueSuffix></valueSuffix>
<delimiter> OR </delimiter>
<choice value="*">*</choice>
</input>
I have just added <choice value="*">*</choice>
and changed emaiLtype
to emailtype
.
Thanks
Your token definition is token="emaiLtype"
"emaiLtype" with "L" and the token substitution is index=applogsprd sourcetype=advisor:domain module=communication $emailtype$
with "l". Not sure if it's a typo but just try changing it
Have you tried adding quotes around the value of emailtype
to see if that makes a difference? I was battling something similar the other day and it seemed to finally work after I surrounded the token value in quotes even though I wouldn't have normally put quotes there while writing the search.
Yes, the "L" is causing the "Searching is waiting for input...", change it to "l" makes it go away. However, need to surround the token with " in order to make it work. But it only works with single selected value. In other words:
"email_type=foo" works
"email_type=foo OR email_type=bar" doesn't work, even in the log both email_type "foo" and "bar" exist