Dashboards & Visualizations

How tokenize Multi-select value in a token <set>?

caarroniz
Engager

Hello All,

I am building a dashboard in which I have a Checkbox to trigger a different search when it gets enabled, so this is how my xml looks like:

 

<input type="multiselect" token="multiselect_value" searchWhenChanged="true">
  <search>
   <query>
     |inputlookup myFile.csv | fields values
   </query>
  </search>
<delimiter> OR </delimiter>
<valuePrefix>ServiceName</valuePrefix>
<valueSuffix>"</valueSuffix>
<prefix>(</prefix>
<suffix>)</suffix>
<choise value="*">ALL</choice>
<initialValue>*</initialValue>
</input>
<input  type="checkbox" token="test_checkbox">
  <choise value="true">Enable</choise>
  <change>
     <condition match="$test_checkbox$=&quot;true&quot;">
      <set token=base_query>
       "normal search without any token"
      </set>
   </condition>
   <condition>
    <set token=base_query>
     "search with a token inside" $multiselect_value$
    </set>
   </condition>
  </change>
</input>

 

 

Now, the problem is that the $multiselect_value$ is never taken, I already tried to use the <![CDATA[$multiselect_value$]]> but is not working, is there any other way to do this? if not how could you suggest to tokenize these queries in the condition?

 

Thanks in advance! 😄

Labels (2)
0 Karma
1 Solution

DalJeanis
Legend

if the searches are otherwise identical, then you can just use the multiselect value with the n token to avoid formatting it,  and set the value to a single space when you don't want it to contain anything of significance.

Your search would look more or less like this:

     "search with a token inside" $multiselect_value2|n$

And the checkbox like this: 

<input  type="checkbox" token="test_checkbox">
  <choise value="true">Enable</choise>
  <change>
     <condition match="$test_checkbox$=&quot;true&quot;">
      <set token="multiselect_value2">$multiselect_value$</set>
   </condition>
   <condition>
    <set token="multiselect_value2"></set>
   </condition>
  </change>
</input>

 

That could be made slightly simpler, but that would work.

View solution in original post

0 Karma

DalJeanis
Legend

if the searches are otherwise identical, then you can just use the multiselect value with the n token to avoid formatting it,  and set the value to a single space when you don't want it to contain anything of significance.

Your search would look more or less like this:

     "search with a token inside" $multiselect_value2|n$

And the checkbox like this: 

<input  type="checkbox" token="test_checkbox">
  <choise value="true">Enable</choise>
  <change>
     <condition match="$test_checkbox$=&quot;true&quot;">
      <set token="multiselect_value2">$multiselect_value$</set>
   </condition>
   <condition>
    <set token="multiselect_value2"></set>
   </condition>
  </change>
</input>

 

That could be made slightly simpler, but that would work.

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...