Dashboards & Visualizations

Multiselect option convert to checkbox

Stopplis
Explorer

Hello,

I have a dashboard with multiselection + text input field. 

I'd like to use checkbox instead of multiselect but if I modify it and click the 'Any field' option the dashboard is crashed. 

 

<form version="1.1" theme="light">
  <label>Multiselect Text</label>
  <init>
    <set token="toktext">*</set>
  </init>
  <fieldset submitButton="false">
    <input type="multiselect" token="tokselect">
      <label>Field</label>
      <choice value="Any field">Any field</choice>
      <choice value="category">Group</choice>
      <choice value="severity">Severity</choice>
      <default>category</default>
      <valueSuffix>=REPLACE</valueSuffix>
      <delimiter> OR </delimiter>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <change>
        <eval token="form.tokselect">case(mvcount('form.tokselect')=0,"category",mvcount('form.tokselect')&gt;1 AND mvfind('form.tokselect',"Any field")&gt;0,"Any field",mvcount('form.tokselect')&gt;1 AND mvfind('form.tokselect',"Any field")=0,mvfilter('form.select'!="Any field"),1==1,'form.tokselect')</eval>
        <eval token="tokselect">if('form.tokselect'="Any field","REPLACE",'tokselect')</eval>
        <eval token="tokfilter">replace($tokselect$,"REPLACE","\"".$toktext$."\"")</eval>
      </change>
    </input>
    <input type="text" token="toktext">
      <label>Value</label>
      <default>*</default>
      <change>
        <eval token="tokfilter">replace($tokselect$,"REPLACE","\"".$toktext$."\"")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <title>$tokfilter$</title>
        <search>
          <query>| makeresults</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </event>
    </panel>
  </row>
</form>

 

 Could you please help to modify my dashboard from multiselect option to checkbox?

 

Thank you very much in advance!

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Unlike multi-select, checkboxes do not preserve the order in which selections were made, so you have to use them slightly differently. If nothing is selected, set the selection to the default (this cannot be "Any field"), else, is "Any field" is checked, make it the only selection, otherwise leave it as is.

When it comes to using it, if "Any field" is checked, it must be unchecked (which will revert to the default), before another option can be checked.

<form version="1.1" theme="light">
  <label>Multiselect Text</label>
  <init>
    <set token="toktext">*</set>
  </init>
  <fieldset submitButton="false">
    <input type="checkbox" token="tokcheck">
      <label>Field</label>
      <choice value="Any field">Any field</choice>
      <choice value="category">Group</choice>
      <choice value="severity">Severity</choice>
      <default>category</default>
      <valueSuffix>=REPLACE</valueSuffix>
      <delimiter> OR </delimiter>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <change>
        <eval token="form.tokcheck">case(mvcount('form.tokcheck')=0,"category",isnotnull(mvfind('form.tokcheck',"Any field")),"Any field",1==1,'form.tokcheck')</eval>
        <eval token="tokcheck">if('form.tokcheck'="Any field","REPLACE",'tokcheck')</eval>
        <eval token="tokfilter">replace($tokcheck$,"REPLACE","\"".$toktext$."\"")</eval>
      </change>
    </input>
    <input type="text" token="toktext">
      <label>Value</label>
      <default>*</default>
      <change>
        <eval token="tokfilter">replace($tokselect$,"REPLACE","\"".$toktext$."\"")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <title>$tokfilter$</title>
        <search>
          <query>| makeresults</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </event>
    </panel>
  </row>
</form>

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Unlike multi-select, checkboxes do not preserve the order in which selections were made, so you have to use them slightly differently. If nothing is selected, set the selection to the default (this cannot be "Any field"), else, is "Any field" is checked, make it the only selection, otherwise leave it as is.

When it comes to using it, if "Any field" is checked, it must be unchecked (which will revert to the default), before another option can be checked.

<form version="1.1" theme="light">
  <label>Multiselect Text</label>
  <init>
    <set token="toktext">*</set>
  </init>
  <fieldset submitButton="false">
    <input type="checkbox" token="tokcheck">
      <label>Field</label>
      <choice value="Any field">Any field</choice>
      <choice value="category">Group</choice>
      <choice value="severity">Severity</choice>
      <default>category</default>
      <valueSuffix>=REPLACE</valueSuffix>
      <delimiter> OR </delimiter>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <change>
        <eval token="form.tokcheck">case(mvcount('form.tokcheck')=0,"category",isnotnull(mvfind('form.tokcheck',"Any field")),"Any field",1==1,'form.tokcheck')</eval>
        <eval token="tokcheck">if('form.tokcheck'="Any field","REPLACE",'tokcheck')</eval>
        <eval token="tokfilter">replace($tokcheck$,"REPLACE","\"".$toktext$."\"")</eval>
      </change>
    </input>
    <input type="text" token="toktext">
      <label>Value</label>
      <default>*</default>
      <change>
        <eval token="tokfilter">replace($tokselect$,"REPLACE","\"".$toktext$."\"")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <title>$tokfilter$</title>
        <search>
          <query>| makeresults</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </event>
    </panel>
  </row>
</form>
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...