Dashboards & Visualizations

Using EventHandler with MultiSelectInput

Path Finder

I have a multiselect input and i want to create a couple tokens from a single multiselect. This works with single value inputs but for Multiselects inputs it fails.

Here's the scenario: I have a table like this,
name| state | city
tom| CA | SF
mike|CA |TAHOE
mark|AZ | Phoenix

In the multi select you can select from a list of names and the token will be the states. BUT I also want to create a token for the city at the same time. I tried this:

    var input2 = new MultiSelectInput({
        "id": "input2",
        "delimiter": " ",
        "labelField": "name",
        "searchWhenChanged": true,
        "valueField": "state",
        "value": "$form.multi_select2$",
        "managerid": "search5",
        "el": $('#input2')
    }, {tokens: true}).render();

    input2.on("change", function(newValue) {

   input2.on("valueChange", function(e) {
       if (e.value !== undefined) {
           EventHandler.setToken("field2.cityMultiSelect", "$row.city$", {}, e.data);

When I try the above code it will only populate the $field2.cityMultiSelect$ with one city value, even though the user may have selected multiple names. Is there any what to make $field2.cityMultiSelect$ a multi value token as well?

Tags (3)


@tdiestel, Since the multiselect value just assigns the first selected value as token and ignores the remaining selected multivalues.
alt text

Following JavaScript can be used to iterate through the multi values and return selected comma separated values.
PS: The example is from HTML Dashboard, but the same can be modified for SplunkJS as well.

    input2.on("valueChange", function(e) {
        var loopCounter;
            var tmpMultiValue;
            if (e.value[loopCounter] !== undefined) {
                if(tmpMultiValue == undefined){
                    // First time initialize temporary multivalued data
                    // Prepare comma separated multivalued data
                    // Original code untouched. 
                    // Sets first value. If iterated over data objects (cumulative) this might populate multivalued data.
                    EventHandler.setToken("multiSelect", "$value$", {}, e.data);
        // Custom multi valued token multiValue set using SplunkJS Token Handler.
        // May need to change from default to submitted Token handler as required.
        var tokens = mvc.Components.get("default");
        tokens.set("multiValue", tmpMultiValue);

Once multiValue token is populated the same can be passed to a dummy Splunk Search to iterate and split as multi valued using comma and then expanded as single value results.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma


The change event is not available for multiselect input refer to the documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference

I wish there was an enhancement to multiselect input to handle change.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Path Finder

This is very helpful. One thing I don't understand is why would it not be available for the multiselect, but available for the check box, where you can have several options?

I'll test this out and see if it works as i would expect the multiselect to work. Thank you again.

UPDATE: Just tested out the check box input and same results as the multiselect, which is it doesn't work.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...