How do I make a multiselect dashboard input pretty when multiple default values are provided by a token?

[ruman_splunk]

Hi! I have a dashboard with a multiselect input. Let's pretend it has 3 choices

<input type="multiselect" token="foo">
  <label>bar</label>
  <choice value="1">One</choice>
  <choice value="2">Two</choice>
  <choice value="3">Three</choice>

If I set a default with multiple values, the UI is very pretty

<default>1,2</default> <!-- UI shows "[One] [Two]". Each label is in its own box, very pretty! -->

But if I set a token that contains the same string and use that as the default, the UI shows values instead of labels, which is ugly!

<init><set token="foo_default">1,2</set></init>
...
<default>$foo_default$</default> <!-- UI shows "[1,2]" - only one box, and no labels, ugly, hard to read. -->

How do I get the multiselect UI to render labels when I am supplying multiple default values with a token?

Setting depends="$foo_default$" on the input does not help.

Setting a single default value with a token works as expected.

[ruman_splunk · Accepted solution]

Solution is here! https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-populate-a-multiselect-input-box-...

Thanks @niketn !

[ruman_splunk]

I've discovered two workarounds for this:

1. More generically: create the input in JS using the webframework. You can set a default with multiple values programatically in JS.

   require([
   "splunkjs/mvc/searchmanager",
   "splunkjs/mvc/multidropdownview",
   "splunkjs/mvc/simplexml/ready!"
   ], function(
   SearchManager,
   MultiDropdownView
   ) {
   var foo = new MultiDropdownView({
   id: "foo",
   choices: [
   {label:"One", value: "1"},
   {label:"Two", value: "2"},
   {label:"Three", value: "3"}],
   el: $("#foo")
   }).render();
   foo.settings.set("default", [1, 2]);
   });

2. If (as I do) you have two sets of default options that you're choosing between, create two inputs in SimpleXML identical except for the (inline) default values and show only one of them depending on which set of defaults should be shown.

[jbillings]

"I want to fire an event when the token is set, and update the value of the multiselect, but there doesn't seem to be any way to do that that I can figure out..."

You can pass a token to a search string in your multiselect. It won't set the default, but it will update the available values for the multiselect.

   </input>
<input type="multiselect" token="attack_type">
  <label>Attack Type</label>
  <choice value="*">All</choice>
  <default>*</default>
  <initialValue>*</initialValue>
  <fieldForLabel>attack_type</fieldForLabel>
  <fieldForValue>attack_type</fieldForValue>
  <search>
    <query>index=attack sourcetype=attack:syslog eventtype=attack $policy_name$

| stats count by attack_type
$time.earliest$
$time.latest$

attack_type="
"
OR

[ruman_splunk]

I'm interested here in setting the default value from a token, not setting the options themselves, but thank you!

[ruman_splunk]

It feels like there's something that the UI does when there's an inline default, that gets skipped when the default comes from a token (maybe because the token gets set after the multiselect input initializes)

In which case, I'm looking for some way to kick the input so that it reprocesses the default. I wonder if instead of setting a default, I want to fire an event when the token is set, and update the value of the multiselect, but there doesn't seem to be any way to do that that I can figure out...