Reporting

How to select multiple values in a checkbox for a saved search?

qxu5715
Explorer

I want to build a Dashbaord with a savedsearch and a checkbox input with several values (value1,value2,value3...)

When I am selecting just one value on the UI, the search works fine, but as soon as I'm selecting several values, it is not working anymore. To be honest I am not sure if the reason is my wrong search query or my wrong use of tokens:

<input type="checkbox" token="Token_name" searchWhenChanged="true">
      <label>field1</label>
      <choice value="value1">value1</choice>
      <choice value="value2">value2</choice>
      <choice value="value3">value3</choice>
      <delimiter> OR </delimiter>

<search>
 <query>|savedsearch "saved_Report" |search Value_in_report=$Token_name$</query>
  </search>

I've tried several options of changing the token properties including:

Token Prefix -> (
Token Suffix -> )
Token Value Prefix -> Value_in_report="
Token Value Suffix -> "
Delimiter -> AND,OR

It would be nice, if sb. could explain how the checkbox input is working with several selected values.

Thanks and regards

0 Karma
1 Solution

DalJeanis
Legend

Your later sample should have worked. The only change necessary would seem to be...

|search $Token_name$

One way to debug this would be to add an html display to a panel so that you can see exactly what is being loaded into the checkbox's value. Then open a search screen and paste that into the search where the $Token_name$ is.

View solution in original post

harish_l
New Member

can you please help to select the multiple value, like i need to filter 2 or 3 values out of 6.

This is my search :
|inputlookup target_lookup
| where targetType LIKE("$value$")
| makemv delim="," targetType
|table targetType

Saved search :
| savedsearch filter $value$

Its not working for me. could you please help me to resolve.

0 Karma

DalJeanis
Legend

Your later sample should have worked. The only change necessary would seem to be...

|search $Token_name$

One way to debug this would be to add an html display to a panel so that you can see exactly what is being loaded into the checkbox's value. Then open a search screen and paste that into the search where the $Token_name$ is.

qxu5715
Explorer

Worked well, thanks for the support!

harish_l
New Member

can you please help to select the multiple value, like i need to filter 2 or 3 values out of 6.

This is my search :
|inputlookup target_lookup
| where targetType LIKE("$value$")
| makemv delim="," targetType
|table targetType

Saved search :
| savedsearch filter $value$

Its not working for me. could you please help me to resolve.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...