splunk xml multiselect - set token

[pjac1029]

I created a  dashboard with an input  that allows the user to select a user field from a dropdown that's populated by a lookup table.  I need to use a multiselect input type to allo users to filter for one user or all users.

I created a change form  to prefix the selected user with "production\"
and run a query In the  panel that retrieves firewall events  where the user = the new token value (prefixed with "production\") since the user in the firewall index is prefixed with "production".

the issue is that the set token  runs whenever i change the value in the multiselect and appends "production\" to the token value multiple times

Is there a way to set the token AFTER the user has set the filter? also how do I filter for ALL events (when the user select ALL in the multiselect input? below is my XML code.

Thanks in advance.

<dashboard version="1.1" theme="light">
<label>new firewall</label>

<row>
<panel>
<title> Request Information</title>
<input type="multiselect" token="webuser" searchWhenChanged="true">
<label>User</label>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
<delimiter> </delimiter>
<fieldForLabel>UserName</fieldForLabel>
<fieldForValue>UserName</fieldForValue>
<search>
<query>| inputlookup my_users.csv
| dedup UserName
| table UserName</query>
</search>
<change>
<set token="webuser">prod\\$webuser$</set>
</change>

</input>
<input type="time" token="webtime" searchWhenChanged="true">
<label></label>
<default>
<earliest>-4h@m</earliest>
<latest>now</latest>
</default>
</input>
<table>
<search>
<query>( index = main sourcetype = firewall ) action=blocked | search
[ inputlookup my_users.csv
| eval userName = "prod\\".UserName
| rename userName as user
| table user ]

|table _time, $webuser$ index, action
|search user=$webuser$</query>
<earliest>$webtime.earliest$</earliest>
<latest>$webtime.latest$</latest>
</search>
<option name="drilldown">cell</option>
</table>
</panel>
</row>
</dashboard>

[pjac1029]

thanks for your help. i incorporated the logic to handle "all" and the user prefix.. worked great.

[bowesmana]

To handle an 'All' static option in the multiselect, add this change element

        <change>
          <condition match="$form.webuser=&quot;*&quot;">
            <set token="webuser"></set>
          </condition>
          <condition>
            <eval token="form.webuser">case(mvcount($form.webuser$)="2" AND mvindex($form.webuser$,0)="*", mvindex($form.webuser$,1), mvfind($form.webuser$,"^\\*$$")=mvcount($form.webuser$)-1, "*", true(), $form.webuser$)</eval>
          </condition>
        </change>

[bowesmana]

Note that this means when you select "All" it removes the other options if selected and vice versa, if you have All selected and choose one of the other options, it removes "All" from the list of selections.

[livehybrid]

Hi @pjac1029 

You should use valuePrefix for this:

<valuePrefix>"production\</valuePrefix>

You may also need to change some other fields, including your search, so that you get the *OR* element, I opted for a "WHERE x IN (list)" in the above example.

I used:

      <valuePrefix>"production\</valuePrefix>
      <prefix>user IN (</prefix>
      <suffix>)</suffix>
      <valueSuffix>"</valueSuffix>
      <delimiter>,  </delimiter>

Below is a full working example dashboard:

<form version="1.1">
  <label>Answers production prefix</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="user" searchWhenChanged="true">
      <label>Username</label>
      <fieldForLabel>username</fieldForLabel>
      <fieldForValue>username</fieldForValue>
      <search>
        <query>| makeresults | eval username="Test1" | append [|makeresults | eval username="Test2"] | table username</query>
      </search>
      <valuePrefix>"production\</valuePrefix>
      <prefix>user IN (</prefix>
      <suffix>)</suffix>
      <valueSuffix>"</valueSuffix>
      <delimiter>,  </delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults 
| eval user="production\Test1", action="Action1"
| append [| makeresults | eval user="production\Test2", action="Action2"]
| append [| makeresults | eval user="production\Test3", action="Action3"]
| where $user$</query>
          <earliest>@h</earliest>
          <latest>now</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing