How to pass a token with multiple values to multiselect input as initial values

[philippbloch]

Hello there,

I'm trying to fill a multiselect input with a initial value based on a token. The token is based on a lookup search.

<form>
  <label>dashboard</label>
  <search>
    <query>
           | inputlookup lookup.csv
    </query>
    <earliest>-24h</earliest>
    <latest>now</latest>
    <done>
      <set token="tok_lookup">$result.column$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="multiselect" token="tok_multiselect" searchWhenChanged="false">
      <label>Multi-Select</label>
      <delimiter>,</delimiter>
      <fieldForLabel>column</fieldForLabel>
      <fieldForValue>column</fieldForValue>
      <search>
        <query>| loadjob savedsearch="admin:app:multiselect_list"</query>
        <earliest>-2h@h</earliest>
        <latest>now</latest>
      </search>
      <initialValue>$tok_lookup$</initialValue>
    </input>
  </fieldset>

  ...

 </form>

The inputlookup of lookup.csv does return a single column with multiple rows if run in a seperate search:

column
-----------
value1
value2
value3

value1, value2, value3 should show up as a seperate initial values in the multiselect input. Currently the values do not show up at all. - If I use the token as default, only the first value "value1" is populated to the multiselect field.

Thanks a lot for your help.
Regards,
Philipp

[philippbloch]

I got some new additional information spare: I modified the lookup with mvcombine to have the result in a single row comma-separated:

| mvcombine delim="," field | nomv field

I checked the format how the initial value of the multiselect input needs to be defined:

<initialValue>value1,value2,value3</initialValue>

But passing the token in this style doesn't work as well. The initial value shows up as one huge value. Not in separate values.

If I define the initial value manually by putting in the values by hand (for example in the order of value1,value2,value3) it works perfectly.

Any ideas? Anyone?

[vnravikumar]

Hi

$result.<fieldname>$ -   The token accesses the value from the first row of returned results.

You can check here:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Viz/EventHandlerReference

[philippbloch]

Hi! Thanks for the response. 🙂

I got it. Any idea if it will work if I combine the results to a single row?

For example: value1,value2,value3