First you need to add the "Any field" choice. Then you need to reset the form token depending on whether the last choice has been removed (use default value), whether "Any field" has been added after...
See more...
First you need to add the "Any field" choice. Then you need to reset the form token depending on whether the last choice has been removed (use default value), whether "Any field" has been added after another selection (make "Any field" the only selection), whether another selection has been made after "Any field" (remove "Any field" from the selection, otherwise leave the form token as is. Then you need to reset the token if the form token is "Any field" (so that it just contains "REPLACE". Now, the existing setting of the filter token can replace "REPLACE" with the value from the text input: <form version="1.1" theme="light">
<label>Multiselect Text</label>
<init>
<set token="toktext">*</set>
</init>
<fieldset submitButton="false">
<input type="multiselect" token="tokselect">
<label>Field</label>
<choice value="Any field">Any field</choice>
<choice value="category">Group</choice>
<choice value="severity">Severity</choice>
<default>category</default>
<valueSuffix>=REPLACE</valueSuffix>
<delimiter> OR </delimiter>
<prefix>(</prefix>
<suffix>)</suffix>
<change>
<eval token="form.tokselect">case(mvcount('form.tokselect')=0,"category",mvcount('form.tokselect')>1 AND mvfind('form.tokselect',"Any field")>0,"Any field",mvcount('form.tokselect')>1 AND mvfind('form.tokselect',"Any field")=0,mvfilter('form.select'!="Any field"),1==1,'form.tokselect')</eval>
<eval token="tokselect">if('form.tokselect'="Any field","REPLACE",'tokselect')</eval>
<eval token="tokfilter">replace($tokselect$,"REPLACE","\"".$toktext$."\"")</eval>
</change>
</input>
<input type="text" token="toktext">
<label>Value</label>
<default>*</default>
<change>
<eval token="tokfilter">replace($tokselect$,"REPLACE","\"".$toktext$."\"")</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<event>
<title>$tokfilter$</title>
<search>
<query>| makeresults</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</event>
</panel>
</row>
</form>