Passing token to macro when multiselect

[smanojkumar]

Hi Splunkers,
   I would like to pass the label value to the macro based on some condition, when a single value is selected, the value is correctly passed to macro and search is loading the results but when the multiple values were selected the search is throwing error in macro.

</input>
<input type="multiselect" token="machine" searchWhenChanged="true">
<label>Machine type</label>
<choice value="*">All</choice>
<choice value="VDI">VDI</choice>
<choice value="Industrial">Industrial</choice>
<choice value="Standard">Standard</choice>
<choice value="MacOS">MacOS</choice>
<choice value="**">DMZ</choice>
<default>*</default>
<initialValue>*</initialValue>
<delimiter>, </delimiter>
<change>
<condition match="$label$ == &quot;*DMZ*&quot;">
<set token="machine_type_dmz">"mcafee_DMZ=DMZ"</set>
</condition>
<condition match="$label$ != &quot;*DMZ*&quot;">
<unset token="machine_type_dmz"></unset>
</condition>
</change>
</input>

Thanks in Advance!

[scelikok]

Hi @smanojkumar,

Since you are passing arguments using comma delimiter, it seems does not match the macro definition. 

Solution depends on your macro search definition,  you can update your macro search definition for using OR, you can pass multiple values delimited by  " OR " (with spaces) 

Like below;

</input>
<input type="multiselect" token="machine" searchWhenChanged="true">
<label>Machine type</label>
<choice value="*">All</choice>
<choice value="VDI">VDI</choice>
<choice value="Industrial">Industrial</choice>
<choice value="Standard">Standard</choice>
<choice value="MacOS">MacOS</choice>
<choice value="**">DMZ</choice>
<default>*</default>
<initialValue>*</initialValue>
  <prefix> (</prefix>
  <suffix> )</suffix>
  <delimiter> OR </delimiter>
<change>
<condition match="$label$ == &quot;*DMZ*&quot;">
<set token="machine_type_dmz">"mcafee_DMZ=DMZ"</set>
</condition>
<condition match="$label$ != &quot;*DMZ*&quot;">
<unset token="machine_type_dmz"></unset>
</condition>
</change>
</input>