Unlike multi-select, checkboxes do not preserve the order in which selections were made, so you have to use them slightly differently. If nothing is selected, set the selection to the default (this c...
See more...
Unlike multi-select, checkboxes do not preserve the order in which selections were made, so you have to use them slightly differently. If nothing is selected, set the selection to the default (this cannot be "Any field"), else, is "Any field" is checked, make it the only selection, otherwise leave it as is. When it comes to using it, if "Any field" is checked, it must be unchecked (which will revert to the default), before another option can be checked. <form version="1.1" theme="light">
<label>Multiselect Text</label>
<init>
<set token="toktext">*</set>
</init>
<fieldset submitButton="false">
<input type="checkbox" token="tokcheck">
<label>Field</label>
<choice value="Any field">Any field</choice>
<choice value="category">Group</choice>
<choice value="severity">Severity</choice>
<default>category</default>
<valueSuffix>=REPLACE</valueSuffix>
<delimiter> OR </delimiter>
<prefix>(</prefix>
<suffix>)</suffix>
<change>
<eval token="form.tokcheck">case(mvcount('form.tokcheck')=0,"category",isnotnull(mvfind('form.tokcheck',"Any field")),"Any field",1==1,'form.tokcheck')</eval>
<eval token="tokcheck">if('form.tokcheck'="Any field","REPLACE",'tokcheck')</eval>
<eval token="tokfilter">replace($tokcheck$,"REPLACE","\"".$toktext$."\"")</eval>
</change>
</input>
<input type="text" token="toktext">
<label>Value</label>
<default>*</default>
<change>
<eval token="tokfilter">replace($tokselect$,"REPLACE","\"".$toktext$."\"")</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<event>
<title>$tokfilter$</title>
<search>
<query>| makeresults</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</event>
</panel>
</row>
</form>