Dashboards & Visualizations

Multiselect option convert to checkbox

Stopplis
Explorer

Hello,

I have a dashboard with multiselection + text input field. 

I'd like to use checkbox instead of multiselect but if I modify it and click the 'Any field' option the dashboard is crashed. 

 

<form version="1.1" theme="light">
  <label>Multiselect Text</label>
  <init>
    <set token="toktext">*</set>
  </init>
  <fieldset submitButton="false">
    <input type="multiselect" token="tokselect">
      <label>Field</label>
      <choice value="Any field">Any field</choice>
      <choice value="category">Group</choice>
      <choice value="severity">Severity</choice>
      <default>category</default>
      <valueSuffix>=REPLACE</valueSuffix>
      <delimiter> OR </delimiter>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <change>
        <eval token="form.tokselect">case(mvcount('form.tokselect')=0,"category",mvcount('form.tokselect')&gt;1 AND mvfind('form.tokselect',"Any field")&gt;0,"Any field",mvcount('form.tokselect')&gt;1 AND mvfind('form.tokselect',"Any field")=0,mvfilter('form.select'!="Any field"),1==1,'form.tokselect')</eval>
        <eval token="tokselect">if('form.tokselect'="Any field","REPLACE",'tokselect')</eval>
        <eval token="tokfilter">replace($tokselect$,"REPLACE","\"".$toktext$."\"")</eval>
      </change>
    </input>
    <input type="text" token="toktext">
      <label>Value</label>
      <default>*</default>
      <change>
        <eval token="tokfilter">replace($tokselect$,"REPLACE","\"".$toktext$."\"")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <title>$tokfilter$</title>
        <search>
          <query>| makeresults</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </event>
    </panel>
  </row>
</form>

 

 Could you please help to modify my dashboard from multiselect option to checkbox?

 

Thank you very much in advance!

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Unlike multi-select, checkboxes do not preserve the order in which selections were made, so you have to use them slightly differently. If nothing is selected, set the selection to the default (this cannot be "Any field"), else, is "Any field" is checked, make it the only selection, otherwise leave it as is.

When it comes to using it, if "Any field" is checked, it must be unchecked (which will revert to the default), before another option can be checked.

<form version="1.1" theme="light">
  <label>Multiselect Text</label>
  <init>
    <set token="toktext">*</set>
  </init>
  <fieldset submitButton="false">
    <input type="checkbox" token="tokcheck">
      <label>Field</label>
      <choice value="Any field">Any field</choice>
      <choice value="category">Group</choice>
      <choice value="severity">Severity</choice>
      <default>category</default>
      <valueSuffix>=REPLACE</valueSuffix>
      <delimiter> OR </delimiter>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <change>
        <eval token="form.tokcheck">case(mvcount('form.tokcheck')=0,"category",isnotnull(mvfind('form.tokcheck',"Any field")),"Any field",1==1,'form.tokcheck')</eval>
        <eval token="tokcheck">if('form.tokcheck'="Any field","REPLACE",'tokcheck')</eval>
        <eval token="tokfilter">replace($tokcheck$,"REPLACE","\"".$toktext$."\"")</eval>
      </change>
    </input>
    <input type="text" token="toktext">
      <label>Value</label>
      <default>*</default>
      <change>
        <eval token="tokfilter">replace($tokselect$,"REPLACE","\"".$toktext$."\"")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <title>$tokfilter$</title>
        <search>
          <query>| makeresults</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </event>
    </panel>
  </row>
</form>

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Unlike multi-select, checkboxes do not preserve the order in which selections were made, so you have to use them slightly differently. If nothing is selected, set the selection to the default (this cannot be "Any field"), else, is "Any field" is checked, make it the only selection, otherwise leave it as is.

When it comes to using it, if "Any field" is checked, it must be unchecked (which will revert to the default), before another option can be checked.

<form version="1.1" theme="light">
  <label>Multiselect Text</label>
  <init>
    <set token="toktext">*</set>
  </init>
  <fieldset submitButton="false">
    <input type="checkbox" token="tokcheck">
      <label>Field</label>
      <choice value="Any field">Any field</choice>
      <choice value="category">Group</choice>
      <choice value="severity">Severity</choice>
      <default>category</default>
      <valueSuffix>=REPLACE</valueSuffix>
      <delimiter> OR </delimiter>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <change>
        <eval token="form.tokcheck">case(mvcount('form.tokcheck')=0,"category",isnotnull(mvfind('form.tokcheck',"Any field")),"Any field",1==1,'form.tokcheck')</eval>
        <eval token="tokcheck">if('form.tokcheck'="Any field","REPLACE",'tokcheck')</eval>
        <eval token="tokfilter">replace($tokcheck$,"REPLACE","\"".$toktext$."\"")</eval>
      </change>
    </input>
    <input type="text" token="toktext">
      <label>Value</label>
      <default>*</default>
      <change>
        <eval token="tokfilter">replace($tokselect$,"REPLACE","\"".$toktext$."\"")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <title>$tokfilter$</title>
        <search>
          <query>| makeresults</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </event>
    </panel>
  </row>
</form>
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...