setting a new token when an input token changes: weird delay bug

[gabriel_vasseur]

So I have a form with (among other things) the following input:

<input type="text" token="user_token" searchWhenChanged="true">
  <label>user</label>
  <default></default>
  <change>
    <eval token="user_where_token">if(isnull($user_token$) OR $user_token$=="", "", "| where user=\"" + $user_token$ + "\"")</eval>
  </change>
</input>

I am displaying the content of $user_token$ and $user_where_token$ in an HTML panel for testing purposes, and the behaviour I see is really weird.

Content of field   Value of $user_token$   Value of $user_where_token$    Comment
--------------------------------------------------------------------------------------------------------------------
(empty)            (empty)                 (empty)                        Initial situation, so far so good.
first              first                   (empty)                        After typing "first" in the field and enter
second             second                  | where user="first"           After typing "second" in the field and enter
(empty)            (empty)                 | where user="second"          After emptying the field and enter
third              third                   (empty)                        After typing "third" in the field and enter

So it seems my new token is always set based on how things were BEFORE the field changed. That sounds like a bug to me. Any workaround?

Let me explain what I'm trying to achieve and why I'm trying to go down that route. I originally used "| search user=$user_token$" and use "" as the default value for $user_token$. That way initially the dashboard shows all users, but if someone types a username there (or a pattern), the filter kicks in. The problem is that I have some events with "****" in the user field. Typing that in the filter doesn't filter out anything. I've tried with "*****" too. So I thought I would use a "where" instead of a "search". The problem is that the "where" command now needs to be there ONLY if there is something to filter and not there at all if there isn't. The above is my attempt at achieving that and it almost work, if it wasn't for that weird behaviour.

Any thoughts?

[somesoni2 · Accepted solution]

This should fix that behavior, (instead of using the token, use the current $value$ of the dropdown)

 <input type="text" token="user_token" searchWhenChanged="true">
   <label>user</label>
   <default></default>
   <change>
     <eval token="user_where_token">if(isnull($value$) OR $value$=="", "", "| where user=\"" + $value$ + "\"")</eval>
   </change>
 </input>

[gabriel_vasseur]

That makes sense! And it works too, thanks!

[apatil21]

Has anyone tried this with multiselect input?