Dashboards & Visualizations

Select Multiselect value from URL Token

AKG1_old1
Builder

Hi,
I am using a multi-select input in the dashboard, which displays a list of machines.  I am looking to access this dashboard with  URL having multiple machine comma separated.
My requirement is when I open the link it should have all the machines mentioned in the URL in the multi-select filter

example ( "," replaced with %2C in url)
 http://<URL>?host_token=xxx&form.time_token.earliest=1618437600&form.time_token.latest=1618610400&fo...

 

image.png

Labels (2)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you want a multiselect in the called dashboard to be prepopulated with the values selected in the starting dashboard, I think you can just repeat the variable on the URL

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This might help (assuming you are trying to pass multi-values to another dashboard)

https://community.splunk.com/t5/Splunk-Search/How-to-pass-multiselect-token-values-from-main-dashboa... 

0 Karma

AKG1_old1
Builder

This post is to pass multiselect value to drilldown dashboard but my requirement is other way. I want token to be sent to drilldown dashboard and in drilldown dashboard I have multiselect.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The first part sets up a token from the multi-select. This token is constructed using a mvjoin. If you look at what will actually be passed in the drilldown it looks like this 

/app/yourapp/drilldown?form.drilldownmulti=$drilldownmulti|n$

The drilldownmulti token has been set up with all the values in the multi-select, delimited by "&amp;form.drilldownmulti=". So, for example, if the selected values were A, B, C, the final URL would be

/app/yourapp/drilldown?form.drilldownmulti=A&amp;form.drilldownmulti=B&amp;form.drilldownmulti=C

This then appears in the drilled down dashboard in the drilldownmulti multi-select input as A, B and C being preselected.

So, for your case, you need to call your URL with multiple instances of form.MACHINE_TOKEN=<value> separated by &amp;

Hopefully, that's a bit clearer

0 Karma

AKG1_old1
Builder

 i tried similar approach but issue is when we click to reach drilldown dashboard it convert & and = charater to encoded format and it doent work.

http://<url>?&host_token=xxx&form.time_token.earliest=1618776000&form.time_token.latest=1618863722&%26form.MACHINE_TOKEN%3Dhp548srv%2C%26form.MACHINE_TOKEN%3Dhp675srv%2C%26form.MACHINE_TOKEN%3Dmx24637vm%2C%26form.MACHINE_TOKEN%3Dmx24638vm

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you have the value in a token, use the |n filter to prevent escaping (as shown in the example answer and above)

0 Karma

manjunathmeti
Champion

hi @AKG1_old1,

Instead of comma-separated values, you should pass key-value pairs separated by & in the URL endpoint to put values in multi-select input like below assuming MACHINE_TOKEN is the token name of multi-select input.

http://<url>/?host_token=xxx&form.time_token.earliest=1618437600&form.time_token.latest=1618610400&form.MACHINE_TOKEN=hp707srv&form.MACHINE_TOKEN=dell970srv&form.MACHINE_TOKEN=dell429srv&form.MACHINE_TOKEN=dell477srv&form.MACHINE_TOKEN=dell432srv

 

If this reply helps you, a like would be appreciated.

0 Karma

AKG1_old1
Builder

Thanks, Manually its working  but there is another issue when I am trying to access this URL , special character in URL are getting encoded and it doen't work.

http://<URL>?&host_token=xxx&form.time_token.earliest=1618776000&form.time_token.latest=1618863722&%26form.MACHINE_TOKEN%3Dhp548srv%2C%26form.MACHINE_TOKEN%3Dhp675srv

0 Karma

manjunathmeti
Champion

Use CDATA wrapper to make sure that the & symbol is interpreted correctly

 

<drilldown target="blank">
      <link>
          <![CDATA[
          /app/search/test?host_token=xxx&form.time_token.earliest=1618776000&form.time_token.latest=1618863722&form.MACHINE_TOKEN=hp548srv&form.MACHINE_TOKEN=hp675srv
          ]]>
      </link>
 </drilldown>

 

If this reply helps you, a like would be appreciated.

 

 

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...