Splunk Enterprise

Usage of multiple labels in a multivalue field input?

DaDave
Engager

Hello fellow Splunk developers,

I need to use the selected labels from a multi value input in form of a token. 

For a better explanation I created a short mock-up.

 

 

<form>
  <label>Test</label>
  <fieldset submitButton="false" autoRun="true">
   <input type="multiselect" token="input" searchWhenChanged="true">
      <choice value="A">1</choice>
      <choice value="B">2</choice>
      <choice value="C">3</choice>
      <change>
        <set token="selectedLabel">$label$</set>
        <set token="selectedValue">$input$</set>
      </change> 
    </input>
    <input type="radio" searchWhenChanged="true">
      <label>$selectedLabel$</label>
    </input>
    <input type="radio" searchWhenChanged="true">
      <label>$selectedValue$</label>
    </input>
  </fieldset>
</form>

 

 

If now multiple values are selected the "selectedValue" token contains all the values selected, however the "selectedLabel" token only contains the first value selected as it can be seen in the picture below.

multiValueField.PNG

 

Is this a bug or the intended behavior? Is there a way how to store all labels inside a token? 
Please note that the radio buttons serve only the purpose to show the token values in their label fields. 

 

 

 

Labels (1)
0 Karma
1 Solution

danspav
SplunkTrust
SplunkTrust

Good pickup.

If the token prefix/suffix and field prefix/suffix are used, then the values will get a bit complex, but I haven't yet run into a situation where I couldn't use <change>.

However, seeing how it's unsupported,  if you want to avoid using change then you'd need to rely on JavaScript to manipulate the $label$ token.

Something like:

 

var defaultTokenModel = mvc.Components.get("default");
defaultTokenModel.on("change:input", function(key, value) {
    ...
        // Update the $newLabel$ token value
        defaultTokenModel.set('labels', newLabel);
    });

See Splunk Dev docs for more info:

https://dev.splunk.com/enterprise/docs/developapps/visualizedata/simplexmlextensions/tokenmanipulati...

 

 

View solution in original post

danspav
SplunkTrust
SplunkTrust

Hi @DaDave ,

Here's a way to get the labels and values tokens in a multiselect.

We will encode the key/values into the value field, and use conditional tags to extract the keys for the keys token and the values for the values token.

2023-03-07 09_55_32-Test _ Splunk 9.0.0.pngHere's the dashboard code:

<form version="1.1">
  <label>Test</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="input" searchWhenChanged="true">
      <choice value="A|1">1</choice>
      <choice value="B|2">2</choice>
      <choice value="C|3">3</choice>
      <change>
        <condition match="isnull($input$)">
          <unset token="selectedLabel"></unset>
          <unset token="selectedValue"></unset>
        </condition>
        <condition>
        <eval token="selectedLabel">replace($input$,"[a-zA-Z][|]","")</eval>
        <eval token="selectedValue">replace($input$,"[|][0-9]","")</eval>
        </condition>
      </change>
    </input>
    <input type="radio" searchWhenChanged="true">
      <label>$selectedLabel$</label>
    </input>
    <input type="radio" searchWhenChanged="true">
      <label>$selectedValue$</label>
    </input>
   </fieldset>
  <row><html>
    <table border="1"><tr><th>Value</th><th>Label</th></tr>
    <tr><td>$selectedValue$</td><td>$selectedLabel$</td></tr></table>
  </html><

 

I've updated the values in the multiselect to be in the format: value|key

Then when the multiselect changes we extract everything before the | for the value, and everything after the | for the key.

The replace regex will be a bit more complicated when you use actual data - but the general solution should work.

 

Cheers

Spav

0 Karma

bowesmana
SplunkTrust
SplunkTrust

@danspav Dan, the official docs for multiselect still say that <change> and <condition> are not supported for multiselect inputs

https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#input_.28form...

My experience in the past is that is seems to partially work, but that was some time ago and it clearly works in your example - are you aware of any restrictions in multiselects?

0 Karma

danspav
SplunkTrust
SplunkTrust

Good pickup.

If the token prefix/suffix and field prefix/suffix are used, then the values will get a bit complex, but I haven't yet run into a situation where I couldn't use <change>.

However, seeing how it's unsupported,  if you want to avoid using change then you'd need to rely on JavaScript to manipulate the $label$ token.

Something like:

 

var defaultTokenModel = mvc.Components.get("default");
defaultTokenModel.on("change:input", function(key, value) {
    ...
        // Update the $newLabel$ token value
        defaultTokenModel.set('labels', newLabel);
    });

See Splunk Dev docs for more info:

https://dev.splunk.com/enterprise/docs/developapps/visualizedata/simplexmlextensions/tokenmanipulati...

 

 

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...