Dashboards & Visualizations

How do I add a textbox value to a multiselect input?

kjandhyala
Explorer

I need to add the value of a text box input to a multiselect input. Below is my dashboard XML. Any ideas on how to do that?

For example, if I add "BMW" in the text box, it should get added to the "Car List" Multiselect input. Next, if I add "Toyota", it should get added to the existing values of Multiselect input.

Please help me with this.

<form>
  <label>advancedinputs</label>
  <fieldset submitButton="false">
    <input type="text" token="tkn_car">
      <label>Enter a Car Model</label>
    </input>
    <input type="multiselect" token="carlist">
      <label>Car List</label>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>,</delimiter>
    </input>
  </fieldset>
</form>
0 Karma
1 Solution

kjandhyala
Explorer

I found answer to my own question. For those who are looking for an answer to similar requirement, here is the run anywhere XML. Hope it helps!!

<form>
  <label>Car List dynamically added to multiselect based on textbox input</label>
     <fieldset submitButton="false" autoRun="true">
        <input type="text" token="tkn_car">
          <label>Enter a Car Name</label>
        </input>
        <input type="multiselect" token="carlist">
          <label>Car List</label>
          <valuePrefix>carname="*</valuePrefix>
          <valueSuffix>*"</valueSuffix>
          <delimiter> OR </delimiter>
          <fieldForLabel>field3</fieldForLabel>
          <fieldForValue>field3</fieldForValue>
          <search>
            <query>| makeresults 
            | eval prevcarlist="$form.carlist$"
            | eval newcarlist="$tkn_car$"
            | makemv delim="," prevcarlist
            | makemv delim=" " newcarlist
            | eval field3=mvappend(prevcarlist,newcarlist)
            | eval valcount= mvcount(field3)
            | eval field3=if(valcount>1,mvfilter(NOT match(field3,"all")),field3)
            </query>
            <done>
              <condition match="$job.resultCount$>0">
                <eval token="form.carlist">case(isnotnull($result.field3$),$result.field3$)</eval>
              </condition>
            </done>
            <finalized>
              <condition match="$job.resultCount$>0">
                <unset token="tkn_car"></unset>
              </condition>
            </finalized>
          </search>
          <choice value="*">All</choice>
          <default>*</default>
          <initialValue>*</initialValue>
          <change>
            <eval token="form.carlist">if(mvcount('form.carlist')=0,"*",if(mvcount('form.carlist')!=1,mvfilter('form.carlist'!="*"),'form.carlist'))</eval>
            <unset token="form.tkn_car"></unset>
          </change>
        </input>
      </fieldset>
</form>

View solution in original post

0 Karma

kjandhyala
Explorer

I found answer to my own question. For those who are looking for an answer to similar requirement, here is the run anywhere XML. Hope it helps!!

<form>
  <label>Car List dynamically added to multiselect based on textbox input</label>
     <fieldset submitButton="false" autoRun="true">
        <input type="text" token="tkn_car">
          <label>Enter a Car Name</label>
        </input>
        <input type="multiselect" token="carlist">
          <label>Car List</label>
          <valuePrefix>carname="*</valuePrefix>
          <valueSuffix>*"</valueSuffix>
          <delimiter> OR </delimiter>
          <fieldForLabel>field3</fieldForLabel>
          <fieldForValue>field3</fieldForValue>
          <search>
            <query>| makeresults 
            | eval prevcarlist="$form.carlist$"
            | eval newcarlist="$tkn_car$"
            | makemv delim="," prevcarlist
            | makemv delim=" " newcarlist
            | eval field3=mvappend(prevcarlist,newcarlist)
            | eval valcount= mvcount(field3)
            | eval field3=if(valcount>1,mvfilter(NOT match(field3,"all")),field3)
            </query>
            <done>
              <condition match="$job.resultCount$>0">
                <eval token="form.carlist">case(isnotnull($result.field3$),$result.field3$)</eval>
              </condition>
            </done>
            <finalized>
              <condition match="$job.resultCount$>0">
                <unset token="tkn_car"></unset>
              </condition>
            </finalized>
          </search>
          <choice value="*">All</choice>
          <default>*</default>
          <initialValue>*</initialValue>
          <change>
            <eval token="form.carlist">if(mvcount('form.carlist')=0,"*",if(mvcount('form.carlist')!=1,mvfilter('form.carlist'!="*"),'form.carlist'))</eval>
            <unset token="form.tkn_car"></unset>
          </change>
        </input>
      </fieldset>
</form>
0 Karma

bcusick_splunk
Splunk Employee
Splunk Employee

Well done! Works like a charm.

0 Karma

nabeel652
Builder

You will have to create a lookup table file say carlist.csv.

Now when you'll add a car name and leave the text box (lost focus) it'll add the car in the lookup list. You will read that lookup into your multiselect. You can hide the panel in my example that shows list of cars using

<panel depends="$hidden$">

property however i've left the panel there to show how it is adding the items.

PS: you can add a submit button to avoid erroneous entries on user accidentally leaving the textbox.

<form>
  <label>advancedinputs</label>
  <fieldset submitButton="false">
    <input type="text" token="tkn_car">
      <label>Enter a Car Model</label>
    </input>
    <input type="multiselect" token="carlist">
      <label>Car List</label>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>,</delimiter>
      <fieldForLabel>car_name</fieldForLabel>
      <fieldForValue>car_name</fieldForValue>
      <search>
        <query>| inputlookup carlist.csv</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| inputlookup carlist.csv | append [| makeresults | eval car_name = "$tkn_car$"] | dedup car_name | fields - _time| outputlookup carlist.csv</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

alternatively if you don't want to use a panel with table use this:

<form>
  <label>advancedinputs</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="multiselect" token="carlist">
      <label>Car List</label>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>,</delimiter>
      <fieldForLabel>car_name</fieldForLabel>
      <fieldForValue>car_name</fieldForValue>
      <search>
        <query>| inputlookup carlist.csv | append [| makeresults | eval car_name = "$tkn_car$"] | dedup car_name | search car_name != "" | fields - _time| outputlookup carlist.csv</query>
      </search>
    </input>
    <input type="text" token="tkn_car">
      <label>Enter a Car Model</label>
    </input>
  </fieldset>
</form>
0 Karma

kjandhyala
Explorer

Thanks for the suggestion. The requirement is to make the textbox value as selected value in the carlist multiselect field. For example, if user enters "Toyota", it should be available in form.carlist. Is this possible?

Also, I would like to avoid using a lookup csv, because multiple users can be adding their list of custom filter values into the carlist before running the dashboard. Thanks for any help!

0 Karma

briancronrath
Contributor

I am not so certain there is really anyway to accomplish this short of appending values to a kvstore lookup which the car select list then queries off of searches when the text box value is changed

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...