@thisissplunk, Ideally you should use Splunk JS stack/JavaScript to populate Multiselect value the way you expect. Following is one of the options in Simple XML where you use Table Clicks to create a temporary Comma Separated Value. If the same value is clicked twice then it gets removed from the list.
The list is formatted and fed to a text box. PS: The text box is temporary placeholder and can be hidden using depends Simple XML attribute. The Text boxes <change> event creates a multivalue token from Comma Separated field and assigns the same to Multi Select input.
Please find below a run anywhere example for the dashboard in the attached image:
<form>
<label>Table row to Multiselect</label>
<init>
<set token="tokTmpTable"></set>
</init>
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<input type="multiselect" token="tokMulti" searchWhenChanged="true">
<label>Multiselect Input</label>
</input>
<input type="text" token="tokText" searchWhenChanged="true">
<label>Temporary Text Input to populate Multielect</label>
<change>
<eval token="tokMulti">split($value$,",")</eval>
<eval token="form.tokMulti">split($value$,",")</eval>
</change>
</input>
<table>
<search>
<query>| makeresults
| eval data="INFO,ERROR,WARN,FATAL"
| makemv data delim=","
| mvexpand data
| fields - _time</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<set token="tokTableClick">$row.data$</set>
<eval token="tokTmpTable">case(match(tokTmpTable,$row.data$),replace(tokTmpTable,",".$row.data$,""),true(),tokTmpTable.",".$row.data$)</eval>
<eval token="tokText">ltrim(tokTmpTable,",")</eval>
<eval token="form.tokText">ltrim(tokTmpTable,",")</eval>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<html>
<code>Click same data value twice to remove from Multivalue selection </code>
</html>
</panel>
</row>
<row>
<panel>
<html>
<code>Table Clicked Value</code>: $tokTableClick$
</html>
</panel>
<panel>
<html>
<code>Comma Separated Selected Values for temporary Text Box</code>: $tokTmpTable$
</html>
</panel>
</row>
</form>
@thisissplunk, Ideally you should use Splunk JS stack/JavaScript to populate Multiselect value the way you expect. Following is one of the options in Simple XML where you use Table Clicks to create a temporary Comma Separated Value. If the same value is clicked twice then it gets removed from the list.
The list is formatted and fed to a text box. PS: The text box is temporary placeholder and can be hidden using depends Simple XML attribute. The Text boxes <change> event creates a multivalue token from Comma Separated field and assigns the same to Multi Select input.
Please find below a run anywhere example for the dashboard in the attached image:
<form>
<label>Table row to Multiselect</label>
<init>
<set token="tokTmpTable"></set>
</init>
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<input type="multiselect" token="tokMulti" searchWhenChanged="true">
<label>Multiselect Input</label>
</input>
<input type="text" token="tokText" searchWhenChanged="true">
<label>Temporary Text Input to populate Multielect</label>
<change>
<eval token="tokMulti">split($value$,",")</eval>
<eval token="form.tokMulti">split($value$,",")</eval>
</change>
</input>
<table>
<search>
<query>| makeresults
| eval data="INFO,ERROR,WARN,FATAL"
| makemv data delim=","
| mvexpand data
| fields - _time</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<set token="tokTableClick">$row.data$</set>
<eval token="tokTmpTable">case(match(tokTmpTable,$row.data$),replace(tokTmpTable,",".$row.data$,""),true(),tokTmpTable.",".$row.data$)</eval>
<eval token="tokText">ltrim(tokTmpTable,",")</eval>
<eval token="form.tokText">ltrim(tokTmpTable,",")</eval>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<html>
<code>Click same data value twice to remove from Multivalue selection </code>
</html>
</panel>
</row>
<row>
<panel>
<html>
<code>Table Clicked Value</code>: $tokTableClick$
</html>
</panel>
<panel>
<html>
<code>Comma Separated Selected Values for temporary Text Box</code>: $tokTmpTable$
</html>
</panel>
</row>
</form>
