https://docs.splunk.com/Documentation/Splunk/latest/admin/savedsearchesconf mentions two lookup-generating actions: action.lookup and action.populate_lookup. Some of the differences are clear, though not explicitly listed, in the docs. What's the complete set of differences? When should I use one or the other and when do I have to use outputlookup? action.lookup = <boolean> * Specifies whether the lookup action is enabled for this search. * Default: false action.lookup.filename = <lookup filename> action.lookup.append = <boolean> and action.populate_lookup = <boolean> * Specifies whether the lookup population action is enabled for this search. * Default: false action.populate_lookup.dest = <string> run_on_startup = <boolean> run_n_times = <unsigned integer>    ... View more

Hi! I have a dashboard with a multiselect input. Let's pretend it has 3 choices <input type="multiselect" token="foo"> <label>bar</label> <choice value="1">One</choice> <choice value="2">Two</choice> <choice value="3">Three</choice> If I set a default with multiple values, the UI is very pretty <default>1,2</default> <!-- UI shows "[One] [Two]". Each label is in its own box, very pretty! --> But if I set a token that contains the same string and use that as the default, the UI shows values instead of labels, which is ugly! <init><set token="foo_default">1,2</set></init> ... <default>$foo_default$</default> <!-- UI shows "[1,2]" - only one box, and no labels, ugly, hard to read. --> How do I get the multiselect UI to render labels when I am supplying multiple default values with a token? Setting depends="$foo_default$" on the input does not help. Setting a single default value with a token works as expected. ... View more