well, im using splunk cloud so JS is not an option and i've tries the second option but its not working maybe something in the copy paste became wrong ? <input type="multiselect" token="cat...
See more...
well, im using splunk cloud so JS is not an option and i've tries the second option but its not working maybe something in the copy paste became wrong ? <input type="multiselect" token="categories">
<label>Categories</label>
<choice value="*">ALL</choice>
<fieldForLabel>testCategories</fieldForLabel>
<fieldForValue>testCategories</fieldForValue>
<search>
<query>index="stg_observability_s" sourcetype=SplunkQuality earliest=$time.earliest$ latest=$time.latest$
| search AdditionalData.domain="$domain$" AdditionalData.pipelineName="$pipelineName$" AdditionalData.buildId="$jobid$" AdditionalData.repoUrl="$repo$"
| stats count by testCategories</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<default>*</default>
<initialValue>*</initialValue>
<delimiter> AND </delimiter>
<valuePrefix>testCategories="</valuePrefix>
<valueSuffix>"</valueSuffix>
<change>
<eval token="form.categories">case(mvcount('form.categories')=0,"All",mvcount('form.categories')>1 AND mvfind('form.categories',"All")>0,"All",mvcount('form.categories')>1 AND mvfind('form.categories',"All")=0,mvfilter('form.categories'!="All"),1==1,'form.categories')</eval>
<eval token="categories_choice">if('form.categories'=="All","categories=\"*\"",'categories')</eval>
</change>
</input>