Dashboards & Visualizations

How to extract table records with multi-select

kobayashines
New Member

Hello. I am Japanese. Please allow posting using google translation.

The following sources are created. This source works just by copying and pasting.

<form theme="light">
  <label>FilterTest</label>
  <search id="baseSearch">
    <query>
      | stats count
      | eval _raw="col1, col2, col3
         aaa,bbb,ccc
         ddd,eee,fff
         ggg,hhh,iii"
      | multikv forceheader=1
    </query>
  </search>
  <row>
    <panel>
      <input type="multiselect" token="TableValues">
      <label>TargetValues</label>
      <choice value="*">*</choice>
      <fieldForLabel>valueList</fieldForLabel>
      <fieldForValue>valueList</fieldForValue>
      <search base="baseSearch">
        <query>
          | stats values(col3) as valueList | mvexpand valueList
        </query>
      </search>
      <choice value="*">*</choice>
      <prefix>''</prefix>
    </input>
      <table>
        <search base="baseSearch">
          <query>
             | table col1 col2 col3
           </query>
        </search>
      </table>
    </panel>
  </row>
</form>

When you do this, the table is created as follows:
In addition, the text box lists the value of col3.

col1 col2 col3
aaa bbb ccc
ddd eee fff
ggg hhh iii

◆What i want to do
I want to select "ccc" and "iii" from the text box and extract the records containing this from col3.

How can I do that?

0 Karma
1 Solution

renjith_nair
Legend

@kobayashines ,

Try

<form>
  <label>FilterTest</label>
  <search id="baseSearch">
    <query>| stats count
       | eval _raw="col1, col2, col3
          aaa,bbb,ccc
          ddd,eee,fff
          ggg,hhh,iii"
       | multikv forceheader=1</query>
  </search>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="multiselect" token="TableValues">
        <label>TargetValues</label>
        <choice value="*">*</choice>
        <fieldForLabel>valueList</fieldForLabel>
        <fieldForValue>valueList</fieldForValue>
        <search base="baseSearch">
          <query>| stats values(col3) as valueList | mvexpand valueList</query>
        </search>
        <valuePrefix>col3="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <delimiter>  OR </delimiter>
        <prefix>(</prefix>
        <suffix>)</suffix>
        <default>*</default>
        <initialValue>*</initialValue>
      </input>
      <table>
        <search base="baseSearch">
          <query>|search $TableValues$| table col1 col2 col3</query>
        </search>
      </table>
    </panel>
  </row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@kobayashines ,

Try

<form>
  <label>FilterTest</label>
  <search id="baseSearch">
    <query>| stats count
       | eval _raw="col1, col2, col3
          aaa,bbb,ccc
          ddd,eee,fff
          ggg,hhh,iii"
       | multikv forceheader=1</query>
  </search>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="multiselect" token="TableValues">
        <label>TargetValues</label>
        <choice value="*">*</choice>
        <fieldForLabel>valueList</fieldForLabel>
        <fieldForValue>valueList</fieldForValue>
        <search base="baseSearch">
          <query>| stats values(col3) as valueList | mvexpand valueList</query>
        </search>
        <valuePrefix>col3="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <delimiter>  OR </delimiter>
        <prefix>(</prefix>
        <suffix>)</suffix>
        <default>*</default>
        <initialValue>*</initialValue>
      </input>
      <table>
        <search base="baseSearch">
          <query>|search $TableValues$| table col1 col2 col3</query>
        </search>
      </table>
    </panel>
  </row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

kobayashines
New Member

That is exactly what I wanted to do.
Thank you for the best answer!

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...