如何在 splunk 中访问表单 multi select 输入的标签和值

Question

我有多个 select 输入并且能够获取值但想获取所有标签值。

<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="endpoint" searchWhenChanged="true">
  <label>Endpoints</label>
  <choice value="/project/api-aaa/v1.0">api-aaa</choice>
  <choice value="/project/api-bbb/v1.0">api-bbb</choice>
  <choice value="/project/api-ccc/v1.0">api-ccc</choice>
  <delimiter> OR </delimiter>
  <valuePrefix>"</valuePrefix>
  <valueSuffix>"</valueSuffix>
  <default>/project/api-aaa/v1.0,/project/api-bbb/v1.0,/project/api-ccc/v1.0</default>
  <change>
  <set token="dropToken_label">$label$</set> // this is working partially and able to get first label which is `api-aaa`
  </change>
</input>

<set token="dropToken_label">$label$</set> // 这部分工作并且能够获得第一个标签，即 api-aaa

我需要访问所有标签 selected ?

Answer 1

要访问您需要使用分隔符的所有标签：delimiter=","

<change>
<set token="dropToken_label" delimiter=",">$label$</set>
</change>

如何在 splunk 中访问表单 multi select 输入的标签和值

how to access labels and values of form multi select inputs in splunk

splunk

splunk-query