Based on this solution Solved: How do I add a textbox value to a multiselect inpu... - Splunk Community please try following xml: <form version="1.1"> <label>IP List dynamically added to multiselec...
See more...
Based on this solution Solved: How do I add a textbox value to a multiselect inpu... - Splunk Community please try following xml: <form version="1.1"> <label>IP List dynamically added to multiselect based on textbox input</label> <fieldset submitButton="false" autoRun="true"> <input type="text" token="tkn_ip"> <label>Enter a IP (range)</label> </input> <input type="multiselect" token="iplist"> <label>IP List</label> <valuePrefix>clientip</valuePrefix> <delimiter> OR </delimiter> <fieldForLabel>field3</fieldForLabel> <fieldForValue>field3</fieldForValue> <search> <query>| makeresults | eval previplist="$form.iplist$" | eval newiplist="$tkn_ip$" | makemv delim="," previplist | makemv delim=" " newiplist | eval field3=mvappend(previplist,newiplist) | eval valcount= mvcount(field3) | eval field3=if(valcount>1,mvfilter(NOT match(field3,"all")),field3) </query> <done> <condition match="$job.resultCount$>0"> <eval token="form.iplist">case(isnotnull($result.field3$),$result.field3$)</eval> </condition> </done> <finalized> <condition match="$job.resultCount$>0"> <unset token="tkn_ip"></unset> </condition> </finalized> </search> <choice value="=*">All</choice> <change> <eval token="form.iplist">if(mvcount('form.iplist')=0,"=*",if(mvcount('form.iplist')!=1,mvfilter('form.iplist'!="=*"),'form.iplist'))</eval> <unset token="form.tkn_ip"></unset> </change> <default>=*</default> <initialValue>=*</initialValue> </input> </fieldset> <row> <panel> <event> <search> <query>index=_internal $iplist$</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="list.drilldown">none</option> <option name="refresh.display">progressbar</option> </event> </panel> </row> </form>