I dont think that relative_time command is giving the date I need. if today is 9/11, you relative_time command gives 9/10 and I want to get 1/10. eval dateLastMonthUnix=relative_time(now(), "-1mon@mon")   ... View more

I finally solved it, far from perfect but it seems to work. I basically remove all the change events and put a * as value for All. It generated a not optimal query but it works at least.   <input type="multiselect" token="location" searchWhenChanged="true"> <label>Select location</label> <fieldForLabel>location</fieldForLabel> <fieldForValue>location</fieldForValue> <choice value="*">All</choice> <search> <query>index=xxx | dedup location | table location | sort + location</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <valuePrefix>location="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <prefix>(</prefix> <suffix>)</suffix> </input>  Thanks for the support anyway!   ... View more

The issue remains. I tried to simplify it with no luck either. <change> <eval token="location_choice">if(mvfind('form.location',"All")>=0,"location=*",$location$)</eval> </change> Reasoning: if All is part of the selection , location_choice is set to "location=*" otherwise $location$. Unfortunately I get a really weird behaviour. It seems like the value of location_choice remains even after I removed the items in the input field. So the dashboard searches are using the old location_choice , very inconsistent behaviour. could you confirm how does the input actually work? I select a value, the value get appended to the field and fires the change event . Then the eval tag just replace the field value with the result of the case clauses, right? In which moment all prefixes and suffixes are appended? only when the $location$ gets extracted in the second eval? ... View more

I tried once again and it does not work. every time I click in any value of the drop down box, the element seems to be added and removed from the input. <input type="multiselect" token="location"> <label>Select location</label> <fieldForLabel>location</fieldForLabel> <fieldForValue>location</fieldForValue> <search> <query>index=xxx | dedup location | table location | sort + location</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <valuePrefix>location="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <choice value="All">All</choice> <prefix>(</prefix> <suffix>)</suffix> <change> <eval token="form.location">case(mvcount('form.location')=0,"All",mvcount('form.location')&gt;1 AND mvfind('form.location',"All")&gt;0,"All",mvcount('form.location')&gt;1 AND mvfind('form.location',"All")=0,mvfilter('form.location'!="All"),1==1,'form.location')</eval> <eval token="location_choice">if(mvfind('form.location',"All")=0,"location=*",$location$)</eval> </change> </input> ... View more

Thanks for the suggestion but I get an "undefined" error in Splunk while using your proposal. I think that the error comes from the third option in the case clause. <eval token="form.location"> case(mvcount('form.location')==0,"ALL",     // Reasoning: If there is nothing selected... location = "ALL"  mvcount('form.location')>1 AND mvfind('form.location',"ALL")>0,"ALL",  // Reasoning: if there are multiple selections including ALL.... location ="ALL" Unfortunately I dont understand the meaning of the last case. mvcount('form.location')>1 AND mvfind('form.location',"ALL")==0, mvfilter('form.location'!="ALL"),1==1,'form.location') I assume that the purpose is:  "if there are many selections and none is ALL, just leave it untouched. " As it didnt work, I tried to replace it with some other code mvcount('form.location')>1 AND mvfind('form.location',"ALL")==0,'form.location') but it didnt work at all. Actually ALL get locked in the input field, it is not possible to select anything else or even to remove the ALL   ... View more