Splunk Enterprise

Usage of multiple labels in a multivalue field input?

DaDave
Engager

Hello fellow Splunk developers,

I need to use the selected labels from a multi value input in form of a token. 

For a better explanation I created a short mock-up.

 

 

<form>
  <label>Test</label>
  <fieldset submitButton="false" autoRun="true">
   <input type="multiselect" token="input" searchWhenChanged="true">
      <choice value="A">1</choice>
      <choice value="B">2</choice>
      <choice value="C">3</choice>
      <change>
        <set token="selectedLabel">$label$</set>
        <set token="selectedValue">$input$</set>
      </change> 
    </input>
    <input type="radio" searchWhenChanged="true">
      <label>$selectedLabel$</label>
    </input>
    <input type="radio" searchWhenChanged="true">
      <label>$selectedValue$</label>
    </input>
  </fieldset>
</form>

 

 

If now multiple values are selected the "selectedValue" token contains all the values selected, however the "selectedLabel" token only contains the first value selected as it can be seen in the picture below.

multiValueField.PNG

 

Is this a bug or the intended behavior? Is there a way how to store all labels inside a token? 
Please note that the radio buttons serve only the purpose to show the token values in their label fields. 

 

 

 

Labels (1)
0 Karma
1 Solution

danspav
SplunkTrust
SplunkTrust

Good pickup.

If the token prefix/suffix and field prefix/suffix are used, then the values will get a bit complex, but I haven't yet run into a situation where I couldn't use <change>.

However, seeing how it's unsupported,  if you want to avoid using change then you'd need to rely on JavaScript to manipulate the $label$ token.

Something like:

 

var defaultTokenModel = mvc.Components.get("default");
defaultTokenModel.on("change:input", function(key, value) {
    ...
        // Update the $newLabel$ token value
        defaultTokenModel.set('labels', newLabel);
    });

See Splunk Dev docs for more info:

https://dev.splunk.com/enterprise/docs/developapps/visualizedata/simplexmlextensions/tokenmanipulati...

 

 

View solution in original post

danspav
SplunkTrust
SplunkTrust

Hi @DaDave ,

Here's a way to get the labels and values tokens in a multiselect.

We will encode the key/values into the value field, and use conditional tags to extract the keys for the keys token and the values for the values token.

2023-03-07 09_55_32-Test _ Splunk 9.0.0.pngHere's the dashboard code:

<form version="1.1">
  <label>Test</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="input" searchWhenChanged="true">
      <choice value="A|1">1</choice>
      <choice value="B|2">2</choice>
      <choice value="C|3">3</choice>
      <change>
        <condition match="isnull($input$)">
          <unset token="selectedLabel"></unset>
          <unset token="selectedValue"></unset>
        </condition>
        <condition>
        <eval token="selectedLabel">replace($input$,"[a-zA-Z][|]","")</eval>
        <eval token="selectedValue">replace($input$,"[|][0-9]","")</eval>
        </condition>
      </change>
    </input>
    <input type="radio" searchWhenChanged="true">
      <label>$selectedLabel$</label>
    </input>
    <input type="radio" searchWhenChanged="true">
      <label>$selectedValue$</label>
    </input>
   </fieldset>
  <row><html>
    <table border="1"><tr><th>Value</th><th>Label</th></tr>
    <tr><td>$selectedValue$</td><td>$selectedLabel$</td></tr></table>
  </html><

 

I've updated the values in the multiselect to be in the format: value|key

Then when the multiselect changes we extract everything before the | for the value, and everything after the | for the key.

The replace regex will be a bit more complicated when you use actual data - but the general solution should work.

 

Cheers

Spav

0 Karma

bowesmana
SplunkTrust
SplunkTrust

@danspav Dan, the official docs for multiselect still say that <change> and <condition> are not supported for multiselect inputs

https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#input_.28form...

My experience in the past is that is seems to partially work, but that was some time ago and it clearly works in your example - are you aware of any restrictions in multiselects?

0 Karma

danspav
SplunkTrust
SplunkTrust

Good pickup.

If the token prefix/suffix and field prefix/suffix are used, then the values will get a bit complex, but I haven't yet run into a situation where I couldn't use <change>.

However, seeing how it's unsupported,  if you want to avoid using change then you'd need to rely on JavaScript to manipulate the $label$ token.

Something like:

 

var defaultTokenModel = mvc.Components.get("default");
defaultTokenModel.on("change:input", function(key, value) {
    ...
        // Update the $newLabel$ token value
        defaultTokenModel.set('labels', newLabel);
    });

See Splunk Dev docs for more info:

https://dev.splunk.com/enterprise/docs/developapps/visualizedata/simplexmlextensions/tokenmanipulati...

 

 

Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...