Answer
This happens when the filter expression wraps the parameter in its own quotes (like IN ('$SITE$')) — that resolves to a single quoted string containing commas, not multiple separate values, so it only ever matches one row. Two things fix it: don't add your own surrounding quotes around a multi-select parameter if the values already come through pre-quoted and comma-separated (so it resolves to IN ('C0158','C0152') rather than IN ('C0158,C0152')); or, more robustly regardless of how the parameter is quoted, split it programmatically with something like CONTRACT IN (SELECT REGEXP_SUBSTR('$SITE$', '[^,]+', 1, LEVEL) FROM DUAL CONNECT BY REGEXP_SUBSTR('$SITE$', '[^,]+', 1, LEVEL) IS NOT NULL) — this reliably turns a comma-separated parameter value into multiple matchable values regardless of quoting, and can be combined with a similar company-level filter for filtering by company down to that company's sites.