Dear All Is it possible to have the value of two or more choice values of a multi-select dynamic, from tokens, ex initialized on the form. in the <input type="multiselect" token="field3"> <label>field3</label> <choice value="aaa">Choice1</choice> <choice value="bbb">Choice2</choice> <choice value="ccc">Choice3</choice> <choice value="ddd">Choice4</choice> </input> replace the third Choice with: <choice value=$token1$>Choice3</choice> where token1 is a variable that has been initialized on top of the form. <init> <set token="token1">value</set> <set token="token2">value</set> </init> And the fourth choice with token2. Using the way above, I received a syntax error in the editor - "Unquoted attribute value" If I do quote, then I have the quoted string and not the token value. please advise best regards Altin ... View more

Dear All, I have a YES/NO field named "FIELD2" which I want to search with a single checkbox token named "Checkbox1" , in the following way: Checkbox1.checked = TRUE search: index=db FIELD1= FIELD2="YES" Checkbox2.checked = FALSE search: index=db FIELD1= FIELD2="*" or better search: index=db FIELD1= I tried with condition and match but no result. Can someone advise "from scratch"? best regards Altin ... View more

Dear All I have a Drop Down (named Database) which loads list of options dynamically via a search initially started in a saved-search, saved top of the form. The form has also a time token input and a Submit button. The saved search is bound to the time token (see code below) The problem is that when I change the time in the time token - the Drop-Down list of values is not refreshed. Please see the code below, start of the form to Submit button: <form> <label>Scan Compare 001</label> <!-- This limits events passed to post-process search --> <search id="vln_base"> <query> `mc_vln` </query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <search id="vln_cmp"> <query>`mc_comp($field_scan_run_id$,$field_scan_bs_id$)`</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <fieldset submitButton="true" autoRun="false"> <input type="time" token="field1" searchWhenChanged="false"> <label>Time</label> <default> <earliest>-30d@d</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="field_db_name" searchWhenChanged="true"> <label>Database</label> <fieldForLabel>DB_NAME</fieldForLabel> <fieldForValue>DB_NAME</fieldForValue> <search base="vln_base"> <query>DEDUP DB_NAME | FIELDS DB_NAME</query> </search> <change> <set token="db_name_no_quotes">$value$</set> </change> <prefix>"</prefix> <suffix>"</suffix> </input> <input type="dropdown" token="field_scan_run_id" searchWhenChanged="false"> <label>Scan Id Run</label> <search base="vln_base"> <query>search DB_NAME=$field_db_name$ | stats earliest(_time) as SCAN_DT_START by DB_NAME SCAN_ID | sort - SCAN_DT_START</query> </search> <fieldForLabel>SCAN_ID</fieldForLabel> <fieldForValue>SCAN_ID</fieldForValue> <change> <set token="scan_run_id_no_quotes">$value$</set> </change> <prefix>"</prefix> <suffix>"</suffix> </input> <input type="dropdown" token="field_scan_bs_id" searchWhenChanged="false"> <label>Scan Id Baseline</label> <fieldForLabel>SCAN_ID</fieldForLabel> <fieldForValue>SCAN_ID</fieldForValue> <change> <set token="scan_bs_id_no_quotes">$value$</set> </change> <search base="vln_base"> <query> <![CDATA[ search DB_NAME=$field_db_name$ | stats earliest(_time) as SCAN_DT_START by DB_NAME SCAN_ID | sort - SCAN_DT_START ]]> </query> </search> <prefix>"</prefix> <suffix>"</suffix> </input> <input type="dropdown" token="field_cmp_code" searchWhenChanged="true"> <label>Comparison</label> <showClearButton>false</showClearButton> <choice value="ALL_NO_FIELD_ALL">ALL</choice> <choice value="Unchanged">Changes Only</choice> <selectFirstChoice>true</selectFirstChoice> </input> </fieldset> <row> ....................................................................................................... If I renounce using a saved search in the Database drop down, and use a direct search (see code below) <input type="dropdown" token="field_db_name" searchWhenChanged="true"> <label>Database</label> <fieldForLabel>DB_NAME</fieldForLabel> <fieldForValue>DB_NAME</fieldForValue> <search base="vln_base"> <query>DEDUP DB_NAME | FIELDS DB_NAME</query> </search> <change> <set token="db_name_no_quotes">$value$</set> </change> <prefix>"</prefix> <suffix>"</suffix> </input> replaced with <input type="dropdown" token="field_db_name" searchWhenChanged="true"> <label>Database</label> <fieldForLabel>DB_NAME</fieldForLabel> <fieldForValue>DB_NAME</fieldForValue> <search> <query>index=omega_ds | DEDUP DB_NAME | FIELDS DB_NAME</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <change> <set token="db_name_no_quotes">$value$</set> </change> <prefix>"</prefix> <suffix>"</suffix> </input> then the Database Drop Down starts responding to changes in token, it reloads the options list each time the time is changed. Back into the problematic case with saved search - I can have the Database Drop Down reloaded by pressing the Submit button. But I need to have it respond to the Time Picker (token) - the Submit button is needed for later (in form) dashboards. My question: Q1. Why the options list search direct VS / saved-search makes a difference on this? Q2. How can I have this problem fixed by using saved-search in the Drop-Down? best regards, Altin at your disposal for further info/query ... View more