Is there a way to use Splunk multiselect with multiple panels?

[barrowvian]

Hi,

I copied some code used in a previous answer for using multiselect tool. The code would allow the user to show either one panel, the other panel, or both panels. I would like to expand upon this with a third panel in the mix, having the option to show either one panel individually, all panels, or two of the three panels dynamically. I updated the code to add the third panel in there. I'm assuming that Splunk only likes to have one token active for this kind of search? Which is why it worked for one panel, the other panel, or both panels because at any one time only one token will have been active. I'm sure it could be written in a way that would add in a few extra lines to create a few extra token choices, so that only one token would still be active based upon the users choices. However, if it expands to 5,6,7+ panels then that's going to be a lot of logic to write in order to have a token for every possible combination.

Is there a way to do this dynamically so that other panels could be added in future, without having to make a huge number of changes to the logic? Any help would be appreciated, thank you.

<form>
       <label>Vendor Select</label>
        <fieldset submitButton="false">
          <input type="time" token="field1">
            <label></label>
            <default>
              <earliest>-60m@m</earliest>
              <latest>now</latest>
            </default>
          </input>
          <input type="multiselect" token="service_tok" searchWhenChanged="true">
            <label>Select Application</label>
            <choice value="*">All</choice>
            <choice value="show_ansa">ANSA</choice>
            <choice value="show_meta">MetaPost</choice>
            <choice value="show_test3">3rd Test</choice>
            <change>
             <unset token="tokShowAll"></unset>
             <unset token="tokShowAnsa"></unset>
             <unset token="tokShowMeta"></unset>
             <unset token="tokShowTest3"></unset>
            </change>
          </input>
        </fieldset>
        <search>
          <query>
    | makeresults
            | fields - _time
            | eval data="$service_tok$"
            | eval condition=case(match(data,"\*"),
            "show_all",
            match(data,"show_ansa") 
            AND match(data,"show_meta")
            AND match(data,"show_test3"),
            "show_all",
            match(data,"show_ansa"),"show_ansa",
            match(data,"show_meta"),"show_meta",
            match(data,"show_test3"),"show_test3"
            )
            | eval show_all=case(condition="show_all","true")
            | eval show_ansa=case(condition="show_ansa" OR condition="show_all","true")
            | eval show_meta=case(condition="show_meta" OR condition="show_all","true")
            | eval show_test3=case(condition="show_test3" OR condition="show_all","true")

          </query>
          <done>
            <condition match="$job.resultCount$!=0">
             <eval token="tokShowAll">case(isnotnull($result.show_all$),$result.show_all$)</eval>
             <eval token="tokShowAnsa">case(isnotnull($result.show_ansa$),$result.show_ansa$)</eval>
             <eval token="tokShowMeta">case(isnotnull($result.show_meta$),$result.show_meta$)</eval>
             <eval token="tokShowTest3">case(isnotnull($result.show_test3$),$result.show_test3$)</eval>
            </condition>
            <condition>
             <unset token="tokShowAll"></unset>
             <unset token="tokShowAnsa"></unset>
             <unset token="tokShowMeta"></unset>
             <unset token="tokShowTest3"></unset>
            </condition>
          </done>
        </search>

[DalJeanis · Accepted solution]

Try replacing the search query (lines 27-43) with this...

 <query>
    | makeresults
    | fields - _time
    | eval data="$service_tok$"
    | makemv delim=" " data
    | mvexpand data
    | eval show_ansa=case(data="*","show_all",data="show_ansa",data)
    | eval show_meta=case(data="*","show_all",data="show_meta",data)
    | eval show_test3=case(data="*","show_all",data="show_test3",data)
    | table show_ansa show_meta show_test3
    | stats max(*) as *
  </query>

[DalJeanis]

I believe the token tokShowAll is redundant. The panels should be controlled each by their own token, so show_all doesn't need one.

[barrowvian]

That has worked perfectly, thank you very much for your help!

[DalJeanis]

link to the code you started from.
https://answers.splunk.com/answers/641411/hidedisplay-panels-using-multiselect.html