How do I add a textbox value to a multiselect input?

[kjandhyala]

I need to add the value of a text box input to a multiselect input. Below is my dashboard XML. Any ideas on how to do that?

For example, if I add "BMW" in the text box, it should get added to the "Car List" Multiselect input. Next, if I add "Toyota", it should get added to the existing values of Multiselect input.

Please help me with this.

<form>
  <label>advancedinputs</label>
  <fieldset submitButton="false">
    <input type="text" token="tkn_car">
      <label>Enter a Car Model</label>
    </input>
    <input type="multiselect" token="carlist">
      <label>Car List</label>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>,</delimiter>
    </input>
  </fieldset>
</form>

[kjandhyala · Accepted solution]

I found answer to my own question. For those who are looking for an answer to similar requirement, here is the run anywhere XML. Hope it helps!!

<form>
  <label>Car List dynamically added to multiselect based on textbox input</label>
     <fieldset submitButton="false" autoRun="true">
        <input type="text" token="tkn_car">
          <label>Enter a Car Name</label>
        </input>
        <input type="multiselect" token="carlist">
          <label>Car List</label>
          <valuePrefix>carname="*</valuePrefix>
          <valueSuffix>*"</valueSuffix>
          <delimiter> OR </delimiter>
          <fieldForLabel>field3</fieldForLabel>
          <fieldForValue>field3</fieldForValue>
          <search>
            <query>| makeresults 
            | eval prevcarlist="$form.carlist$"
            | eval newcarlist="$tkn_car$"
            | makemv delim="," prevcarlist
            | makemv delim=" " newcarlist
            | eval field3=mvappend(prevcarlist,newcarlist)
            | eval valcount= mvcount(field3)
            | eval field3=if(valcount>1,mvfilter(NOT match(field3,"all")),field3)
            </query>
            <done>
              <condition match="$job.resultCount$>0">
                <eval token="form.carlist">case(isnotnull($result.field3$),$result.field3$)</eval>
              </condition>
            </done>
            <finalized>
              <condition match="$job.resultCount$>0">
                <unset token="tkn_car"></unset>
              </condition>
            </finalized>
          </search>
          <choice value="*">All</choice>
          <default>*</default>
          <initialValue>*</initialValue>
          <change>
            <eval token="form.carlist">if(mvcount('form.carlist')=0,"*",if(mvcount('form.carlist')!=1,mvfilter('form.carlist'!="*"),'form.carlist'))</eval>
            <unset token="form.tkn_car"></unset>
          </change>
        </input>
      </fieldset>
</form>

[bcusick_splunk]

Well done! Works like a charm.

[nabeel652]

You will have to create a lookup table file say carlist.csv.

Now when you'll add a car name and leave the text box (lost focus) it'll add the car in the lookup list. You will read that lookup into your multiselect. You can hide the panel in my example that shows list of cars using

<panel depends="$hidden$">

property however i've left the panel there to show how it is adding the items.

PS: you can add a submit button to avoid erroneous entries on user accidentally leaving the textbox.

<form>
  <label>advancedinputs</label>
  <fieldset submitButton="false">
    <input type="text" token="tkn_car">
      <label>Enter a Car Model</label>
    </input>
    <input type="multiselect" token="carlist">
      <label>Car List</label>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>,</delimiter>
      <fieldForLabel>car_name</fieldForLabel>
      <fieldForValue>car_name</fieldForValue>
      <search>
        <query>| inputlookup carlist.csv</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| inputlookup carlist.csv | append [| makeresults | eval car_name = "$tkn_car$"] | dedup car_name | fields - _time| outputlookup carlist.csv</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

alternatively if you don't want to use a panel with table use this:

<form>
  <label>advancedinputs</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="multiselect" token="carlist">
      <label>Car List</label>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>,</delimiter>
      <fieldForLabel>car_name</fieldForLabel>
      <fieldForValue>car_name</fieldForValue>
      <search>
        <query>| inputlookup carlist.csv | append [| makeresults | eval car_name = "$tkn_car$"] | dedup car_name | search car_name != "" | fields - _time| outputlookup carlist.csv</query>
      </search>
    </input>
    <input type="text" token="tkn_car">
      <label>Enter a Car Model</label>
    </input>
  </fieldset>
</form>

[kjandhyala]

Thanks for the suggestion. The requirement is to make the textbox value as selected value in the carlist multiselect field. For example, if user enters "Toyota", it should be available in form.carlist. Is this possible?

Also, I would like to avoid using a lookup csv, because multiple users can be adding their list of custom filter values into the carlist before running the dashboard. Thanks for any help!

[briancronrath]

I am not so certain there is really anyway to accomplish this short of appending values to a kvstore lookup which the car select list then queries off of searches when the text box value is changed