topic Re: Usage of multiple labels in a multivalue field input? in Splunk Enterprise

Usage of multiple labels in a multivalue field input?

DaDave — Mon, 06 Mar 2023 15:01:36 GMT

Hello fellow Splunk developers,

I need to use the selected labels from a multi value input in form of a token.

For a better explanation I created a short mock-up.

<form> <label>Test</label> <fieldset submitButton="false" autoRun="true"> <input type="multiselect" token="input" searchWhenChanged="true"> <choice value="A">1</choice> <choice value="B">2</choice> <choice value="C">3</choice> <change> <set token="selectedLabel">$label$</set> <set token="selectedValue">$input$</set> </change> </input> <input type="radio" searchWhenChanged="true"> <label>$selectedLabel$</label> </input> <input type="radio" searchWhenChanged="true"> <label>$selectedValue$</label> </input> </fieldset> </form>

If now multiple values are selected the "selectedValue" token contains all the values selected, however the "selectedLabel" token only contains the first value selected as it can be seen in the picture below.

Is this a bug or the intended behavior? Is there a way how to store all labels inside a token?
Please note that the radio buttons serve only the purpose to show the token values in their label fields.

Re: Usage of multiple labels in a multivalue field input?

danspav — Mon, 06 Mar 2023 22:59:58 GMT

Hi @DaDave ,

Here's a way to get the labels and values tokens in a multiselect.

We will encode the key/values into the value field, and use conditional tags to extract the keys for the keys token and the values for the values token.

Here's the dashboard code:

<form version="1.1"> <label>Test</label> <fieldset submitButton="false" autoRun="true"> <input type="multiselect" token="input" searchWhenChanged="true"> <choice value="A|1">1</choice> <choice value="B|2">2</choice> <choice value="C|3">3</choice> <change> <condition match="isnull($input$)"> <unset token="selectedLabel"></unset> <unset token="selectedValue"></unset> </condition> <condition> <eval token="selectedLabel">replace($input$,"[a-zA-Z][|]","")</eval> <eval token="selectedValue">replace($input$,"[|][0-9]","")</eval> </condition> </change> </input> <input type="radio" searchWhenChanged="true"> <label>$selectedLabel$</label> </input> <input type="radio" searchWhenChanged="true"> <label>$selectedValue$</label> </input> </fieldset> <row><html> <table border="1"><tr><th>Value</th><th>Label</th></tr> <tr><td>$selectedValue$</td><td>$selectedLabel$</td></tr></table> </html><

I've updated the values in the multiselect to be in the format: value|key

Then when the multiselect changes we extract everything before the | for the value, and everything after the | for the key.

The replace regex will be a bit more complicated when you use actual data - but the general solution should work.

Cheers

Spav

Re: Usage of multiple labels in a multivalue field input?

bowesmana — Mon, 06 Mar 2023 23:31:14 GMT

@danspav Dan, the official docs for multiselect still say that <change> and <condition> are not supported for multiselect inputs

https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#input_.28form.29

My experience in the past is that is seems to partially work, but that was some time ago and it clearly works in your example - are you aware of any restrictions in multiselects?

Re: Usage of multiple labels in a multivalue field input?

danspav — Mon, 06 Mar 2023 23:43:04 GMT

Good pickup.

If the token prefix/suffix and field prefix/suffix are used, then the values will get a bit complex, but I haven't yet run into a situation where I couldn't use <change>.

However, seeing how it's unsupported, if you want to avoid using change then you'd need to rely on JavaScript to manipulate the $label$ token.

Something like:

var defaultTokenModel = mvc.Components.get("default"); defaultTokenModel.on("change:input", function(key, value) { ... // Update the $newLabel$ token value defaultTokenModel.set('labels', newLabel); });

See Splunk Dev docs for more info:

https://dev.splunk.com/enterprise/docs/developapps/visualizedata/simplexmlextensions/tokenmanipulation/