Cant get multiselect to evaluate length of selected values

[JAMES201010]

I am using the multiselect input definition below:

The issue is that it is not setting the token named "app_net_fm_entity_id" properly.

The desired behavior is, if the user selects "All" label (value=*) then the condition should detect the "*" value and set the "app_net_fm_entity_id" token to "_all"

If the user selects anything else other than just the "All" label then the "app_net_fm_entity_id" token should be set to the contents of the selected values.

I am using Splunk Enterprise 9.2.1

This is a simple xml dashoard, aka classic dashboard.

I am 1month into splunk and learning feverishly but I surely need some help on this.  I've tried using JS to get the desired behavior for this multi, but couldn't get that to work either 😞 

    <input id="app_nodes_multiselect" type="multiselect" depends="$app_fm_app_id$" token="app_fm_entity_id" searchWhenChanged="true">
      <label>Nodes</label>
      <delimiter> </delimiter>
      <fieldForLabel>entity_name</fieldForLabel>
      <fieldForValue>internal_entity_id</fieldForValue>
      <search>
        <query>
| inputlookup aix_kv_apm_comps WHERE entity_type!=$app_fm_group_nodes$
| search [| makeresults | eval search="internal_parent_id=(".mvjoin($app_fm_app_id$, " OR internal_parent_id=").")" | return $search]
| table entity_name, internal_entity_id
| sort entity_name
        </query>
      </search>
      <choice value="*">All</choice>
      <default>*</default>
        <change>
          <condition>
            <eval>len($value$) == 1</eval>
            <set token="app_net_fm_entity_id">_all</set>
          </condition>         
          
          <condition>
            <eval>len($value$) > 1</eval>
            <set token="app_net_fm_entity_id">$value$</set>
          </condition>
        </change>
    </input>

[JAMES201010]

Well, I did change one thing from your last example.  Here is the final version that worked as required, for those that read this later.

    <input id="app_nodes_multiselect" type="multiselect" depends="$app_fm_app_id$" token="app_fm_entity_id" searchWhenChanged="true">
      <label>Nodes</label>
      <delimiter> </delimiter>
      <fieldForLabel>entity_name</fieldForLabel>
      <fieldForValue>internal_entity_id</fieldForValue>
      <search>
        <query>
| inputlookup aix_kv_apm_comps WHERE entity_type!=$app_fm_group_nodes$
| search [| makeresults | eval search="internal_parent_id=(".mvjoin($app_fm_app_id$, " OR internal_parent_id=").")" | return $search]
| table entity_name, internal_entity_id
| sort entity_name
        </query>
      </search>
      <choice value="*">All</choice>
      <default>*</default>
      
        <change>
          <condition match="$form.app_fm_entity_id$=&quot;*&quot;">
            <set token="app_net_fm_entity_id">_all</set>
            <set token="condition">1</set>
          </condition>
          <condition>
            <set token="condition">2</set>
            <eval token="app_net_fm_entity_id">case(mvcount($form.app_fm_entity_id$)="2" AND mvindex($form.app_fm_entity_id$,0)="*", mvindex($form.app_fm_entity_id$,1), mvfind($form.app_fm_entity_id$,"^\\*$$")=mvcount($form.app_fm_entity_id$)-1, "_all", true(), $form.app_fm_entity_id$)</eval>
            <set token="app_net_fm_entity_id">$app_fm_entity_id$</set>
          </condition>
        </change>      
    </input>

[JAMES201010]

Thank you sooo much!!!  That worked perfectly!!!

[bowesmana]

You can't use $value$ and your <condition> elements are wrong - I assume you're trying to make a conditional expression, however, you just have effectively a single condition

This is the technique to remove all and add all when using multiselect

<change>
  <condition match="$form.app_fm_entity_id$=&quot;*&quot;">
    <eval token="form.app_fm_entity_id">*</eval>
  </condition>
  <condition>
    <eval token="form.app_fm_entity_id">case(mvcount($form.app_fm_entity_id$)="2" AND mvindex($form.app_fm_entity_id$,0)="*", mvindex($form.app_fm_entity_id$,1), mvfind($form.app_fm_entity_id$,"^\\*$$")=mvcount($form.app_fm_entity_id$)-1, "*", true(), $form.app_fm_entity_id$)</eval>
  </condition>
</change>

 It will set the token to * not _all because that is the value defined in your default 'All' option.

[JAMES201010]

WoW!!  Your example got me super close to the finish line!!!

The only issue left is that when I have "All" selected with other options and then unselect other options so that only the "All" option remains, then the "app_net_fm_entity_id" token gets unset, instead of having the value of "_all"

    <input id="app_nodes_multiselect" type="multiselect" depends="$app_fm_app_id$" token="app_fm_entity_id" searchWhenChanged="true">
      <label>Nodes</label>
      <delimiter> </delimiter>
      <fieldForLabel>entity_name</fieldForLabel>
      <fieldForValue>internal_entity_id</fieldForValue>
      <search>
        <query>
| inputlookup aix_kv_apm_comps WHERE entity_type!=$app_fm_group_nodes$
| search [| makeresults | eval search="internal_parent_id=(".mvjoin($app_fm_app_id$, " OR internal_parent_id=").")" | return $search]
| table entity_name, internal_entity_id
| sort entity_name
        </query>
      </search>
      <choice value="*">All</choice>
      <default>*</default>
      
      <change>
        <condition match="$form.app_fm_entity_id$=&quot;*&quot;">
          <eval token="app_net_fm_entity_id">_all</eval>
        </condition>
        <condition>
          <eval token="app_net_fm_entity_id">case(mvcount($form.app_fm_entity_id$)="2" AND mvindex($form.app_fm_entity_id$,0)="*", mvindex($form.app_fm_entity_id$,1), mvfind($form.app_fm_entity_id$,"^\\*$$")=mvcount($form.app_fm_entity_id$)-1, "_all", true(), $form.app_fm_entity_id$)</eval>
        </condition>
         
      </change>   
     
    </input>

[JAMES201010]

Thank you so much for your help!!!

I apologize that I wasn't completely clear in my requirement.

I need the "app_net_fm_entity_id" token set to "_all" IF the "app_fm_entity_id" (aka selectedvalues) has only the "*" value selected.

A different way to say that is, I need the "app_net_fm_entity_id" token set to "_not_star_but_other" IF the "app_fm_entity_id" (aka selectedvalues) has only the "*" value selected.

[bowesmana · Accepted solution]

OK, so you've got two tokens going on here. The default 'All' (*) is selected. When you select one from the list, the intention is that the All (*) should disappear otherwise the selected options are *,1 (or whatever 1 is in your case). So, my condition resets the form. token so that it removes * from the options.

What token are you actually using in the search? Are you using app_fm_entity_id or app_net_fm_entity_id

If you need a second token which also has the word "_all" when * is selected, then your problem is that you are using <eval> to set that token, when you just need to use <set>

I use an html panel sometimes to debug tokens - multiselect behaviour is a little unintuitive and technically the documentation says that <change> is not supported for multiselect, but it does work, it's just odd...

    <panel>
      <input id="app_nodes_multiselect" type="multiselect" token="app_fm_entity_id" searchWhenChanged="true">
        <label>Nodes</label>
        <delimiter> </delimiter>
        <fieldForLabel>entity_name</fieldForLabel>
        <fieldForValue>internal_entity_id</fieldForValue>
        <search>
          <query>
| makeresults count=5
| streamstats c
| eval entity_name="name:".c, internal_entity_id=c
| table entity_name, internal_entity_id
| sort entity_name
          </query>
        </search>
        <choice value="*">All</choice>
        <default>*</default>
        <change>
          <condition match="$form.app_fm_entity_id$=&quot;*&quot;">
            <set token="app_net_fm_entity_id">_all</set>
            <set token="condition">1</set>
          </condition>
          <condition>
            <set token="condition">2</set>
            <eval token="form.app_fm_entity_id">case(mvcount($form.app_fm_entity_id$)="2" AND mvindex($form.app_fm_entity_id$,0)="*", mvindex($form.app_fm_entity_id$,1), mvfind($form.app_fm_entity_id$,"^\\*$$")=mvcount($form.app_fm_entity_id$)-1, "_all", true(), $form.app_fm_entity_id$)</eval>
            <set token="app_net_fm_entity_id">$app_fm_entity_id$</set>
          </condition>
        </change>   
      </input>      
      <html>
        app_fm_entity_id::$app_fm_entity_id$<p/>
        form.app_fm_entity_id::$form.app_fm_entity_id$<p/>
        app_fm_entity_id::$app_fm_entity_id$<p/>
        app_net_fm_entity_id::$app_net_fm_entity_id$<p/>
        condition::$condition$
      </html>
    </panel>