Multiselect choice value dynamic from token

[altink]

Dear All

Is it possible to have the value of two or more choice values of a multi-select dynamic, from tokens, ex initialized on the form.
in the

    <input type="multiselect" token="field3">
      <label>field3</label>
      <choice value="aaa">Choice1</choice>
      <choice value="bbb">Choice2</choice>
      <choice value="ccc">Choice3</choice>
     <choice value="ddd">Choice4</choice>
    </input>
  replace the third Choice with:

<choice value=$token1$>Choice3</choice>

where token1 is a variable that has been initialized on top of the form.

<init>
    <set token="token1">value</set>
   <set token="token2">value</set>
  </init>

And the fourth choice with token2.

Using the way above, I received a syntax error in the editor - "Unquoted attribute value"
If I do quote, then I have the quoted string and not the token value.

please advise

best regards
Altin

[zonistj]

Do you need it to be part of the static options? You can use a token in the dynamic portion of the multi-select options:

  <init> <set token="token_test1"> "tester1" </set></init>

...

    <input type="multiselect" token="field1">
      <label>field1</label>
      <choice value="1">aaa</choice>
      <choice value="2">bbb</choice>
      <choice value="3">ccc</choice>
      <fieldForLabel>token_value</fieldForLabel>
      <fieldForValue>token_value</fieldForValue>
      <search>
        <query>|localop| stats count | eval count = $token_test1$ | rename count AS token_value</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
    </input>

This populates with the token and token value.

[altink]

thank you very much for the answer.

I think there is a problem here. I need to have a Choice4 as label.
I did replace the code

<fieldForLabel>Choice4</fieldForLabel>
<fieldForValue>token_value</fieldForValue>

but I keep having tester1 (the value), instead of the needed caption Choice4

best regards
Altin

[zonistj]

You have to change "fieldForLabel" and "fieldForValue" to whatever you're passing for your token. Essentially, they should both be set to whatever you rename your field to in the dynamic search query.

If you want it to be Choice4 then it should look like this:

   <init> <set token="choice_four"> "4" </set></init>

 ...

     <input type="multiselect" token="field1">
       <label>field1</label>
       <choice value="1">Choice1</choice>
       <choice value="2">Choice2</choice>
       <choice value="3">Choice3</choice>
       <fieldForLabel>Choice4</fieldForLabel>
       <fieldForValue>Choice4</fieldForValue>
       <search>
         <query>|localop| stats count | eval count = $choice_four$ | rename count AS Choice4</query>
         <earliest>-15m</earliest>
         <latest>now</latest>
       </search>
     </input>

[altink]

The problem persists, I have 4 (the value) listed in the drop-down, instead of label - Choice4.

below is the code as by your proposal:

  <init>
    <set token="choice_four">"4"</set>
  </init>
.......................................

    <input type="multiselect" token="field3">
      <label>field3</label>
      <choice value="aaa">Choice1</choice>
      <choice value="bbb">Choice2</choice>
      <choice value="ccc">Choice3</choice>

       <fieldForLabel>Choice4</fieldForLabel>
       <fieldForValue>Choice4</fieldForValue>
       <search>
         <query>|localop| stats count | eval count = $choice_four$ | rename count AS Choice4</query>
       </search>
    </input>

best regards,
Altin

[altink]

Splunk 6.5.2

[altink]

the search itself

localop | stats count | eval count = 4 | rename count AS Choice4

where $choice_four$ has been replaced with its value 4, performs correctly. It returns a single column named Choice4, single row, value 4.

Looks the problem is in the multiselect.

best regards
Altin

[altink]

Please forgive me for not explaining in full my idea originally. I was not that clear myself.
What I need to do with the multi-select is to have Captions that will lead to "values", the later being instead search strings that I will add, if selected, to the "base" one.
That is why I edited the question to ask for least two dynamic options, instead of the original one.

best regards
Altin