Dashboards with filtering data using variables

[patryk_ozimek]

Hi,

I have a dashboard with variable captured from bizevents data. It is a numeric value (type long). I want to filter bizevents for values choosen in the variable list. Single value works fine because it is enough to use "| filter positionDepot == toLong($positionDepot)". In the multiselect in my opinion I should use "| filter in(positionDepot, array($positionDepot)"

But it doesn't work. I mean there is no error but tile says "The are no records"

The workaround for it is:

Variable definition:

fetch bizevents
| filter event.provider == "XXXXX"
| fields positionDepot = toString(positionDepot)
| summarize positionDepot = collectDistinct(positionDepot)

Tile DQL query:

fetch bizevents
| filter event.provider == "XXXXX
| filter in(toString(positionDepot), array($positionDepot))
| fields timestamp, positionDepot

In this setup everything works fine but in my opinion it can be done in a proper way.

Any ideas how to do it?

Best Regards
Patryk

[AntonPineiro · Accepted solution]

Hi,

I will provide and example to filter a table by hostname.

Variable:

fetch dt.entity.host
| fieldsKeep entity.name

 DQL query:

fetch dt.entity.host
| filter in(entity.name, array($HOSTNAME))

 Important is variable only return values about one dimension. I am using "fieldsKeep" to have just values in one field.

I would use something as that, instead of summarize + collectDistinct.

Best regards