Two multi-select input boxes, if the user puts a value in one hide the other one

[dbcase]

Hi,

I have this XML code. What I'd like to do is if the user selects a premise ID input value, then hide (or blank) the mac id input. If the user selects a mac id value then hide (or blank) the premise ID value. Right now I have the dashboard working but its kinda hokey. If the user selects a premise id all the queries run just fine but it puts the premise id in the mac id input box because I'm using the same token (intentionally). I cant seem to figure out a way to get all the queries working without re-using the token.

<form>
  <label>blah Cameras</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="time_field1" searchWhenChanged="false">
      <label>Select a time period</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="multiselect" token="premise_id_field" searchWhenChanged="true">
      <label>Enter a Premise ID</label>
      <fieldForLabel>premiseid</fieldForLabel>
      <fieldForValue>premiseid</fieldForValue>
      <search>
        <query>index="blah_camera_status" sourcetype=access_combined_blah_camerastatus |rex  "Premise=\s+(?<premiseid>\d+)"|dedup premiseid</query>
        <earliest>$time_field1.earliest$</earliest>
        <latest>$time_field1.latest$</latest>
      </search>
      <delimiter> </delimiter>
      <change>

          <set token="panelyes">1</set>


      </change>
    </input>
    <input type="multiselect" token="premise_id_field" searchWhenChanged="true">
      <label>Enter a MAC ID</label>
      <fieldForLabel>premiseid</fieldForLabel>
      <fieldForValue>premiseid</fieldForValue>
      <search>
        <query>index="blah_camera_status" sourcetype=access_combined_blah_camerastatus |rex max_match=0 "Mac=\s+(?<premiseid>[a-fA-F0-9\.:-]{12,17})"|mvexpand premiseid|dedup premiseid</query>
        <earliest>$time_field1.earliest$</earliest>
        <latest>$time_field1.latest$</latest>
      </search>
      <delimiter> </delimiter>

      <change>

          <set token="panelyes">1</set>


      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$panelyes$">
      <title>Camera List by for $premise_id_field$</title>
      <table>
        <search>
          <query>index="blah_camera_status" sourcetype=access_combined_blah_camerastatus $premise_id_field$  |rex max_match=0 "Premise=\s+(?&lt;premiseid&gt;\d+)"|rex max_match=0 "Name=\s+(?&lt;cname&gt;.+)"|rex max_match=0 "Mac=\s+(?&lt;macid&gt;[a-fA-F0-9\.:-]{12,17})"|rex max_match=0 "RSSI=\s+(?&lt;rssiid&gt;[^\s]+)"|rex max_match=0 "Model=\s+(?&lt;cmodel&gt;.+)"|dedup macid|eval temp=mvzip(mvzip(mvzip(macid,rssiid,"###"),cmodel,"###"),cname,"###")|mvexpand temp | rex field=temp "(?&lt;macid&gt;.+)###(?&lt;rssiid&gt;.+)###(?&lt;cmodel&gt;.+)###(?&lt;cname&gt;.+)"|eval rssiid=if(cmodel="iCamera2-C" AND rssiid!=0, rssiid+-20,rssiid)|eval rssiid=if(rssiid="dB",0,rssiid)|stats list(cname) as "Camera Name" list(macid) as MAC, list(cmodel) as "Camera Model" count(macid) as "Number of Cameras", list(rssiid) as RSSI  by premiseid|sort premiseid RSSI|rename RSSI as "Current RSSI"|rename premiseid as "PREMISE"</query>
          <earliest>$time_field1.earliest$</earliest>
          <latest>$time_field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">5</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$panelyes$">
      <title>RSSI values by camera for $premise_id_field$</title>
      <chart>
        <search>
          <query>index="blah_camera_status" sourcetype=access_combined_blah_camerastatus $premise_id_field$|rex max_match=0 "Premise=\s+(?&lt;premiseid&gt;\d+)"|rex max_match=0 "Mac=\s+(?&lt;macid&gt;[a-fA-F0-9\.:-]{12,17})"|rex max_match=0 "RSSI=\s+(?&lt;rssiid&gt;[^\s]+)"|rex max_match=0 "Model=\s+(?&lt;cmodel&gt;.+)"|eval rssiid=if((cmodel="iCamera2-C") OR (rssiid=0),rssiid,rssiid+-20)| eval temp=mvzip(mvzip(macid,rssiid,"###"),cmodel,"###")|mvexpand temp | rex field=temp "(?&lt;macid&gt;.+)###(?&lt;rssiid&gt;.+)###(?&lt;cmodel&gt;.+)"|eval rssiid=if(cmodel="iCamera2-C" AND rssiid!=0, rssiid+-20,rssiid)|eval rssiid=if(rssiid="dB",0,rssiid)
 |timechart span=1hr values(rssiid) as RSSI by macid</query>
          <earliest>$time_field1.earliest$</earliest>
          <latest>$time_field1.latest$</latest>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">connect</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">none</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trellis.splitBy">macid</option>
      </chart>
    </panel>
  </row>

[dbcase · Accepted solution]

Solved it by going another direction, here is the relevant XML

<fieldset submitButton="false" autoRun="false">
    <input type="time" token="time_field1" searchWhenChanged="true">
      <label>Select a time period</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>

    <input type="radio" token="dummy" searchWhenChanged="true">
      <label>Search by:</label>

      <choice value="Premise">Premise</choice>
      <choice value="MAC">MAC</choice>
      <change>
        <condition value="Premise">
          <set token="displaypremise"></set>
          <unset token="displaymac"></unset>
          <unset token="form.premise_id_field"></unset>
        </condition>

        <condition value="MAC">
          <unset token="displaypremise"></unset>
          <set token="displaymac"></set>
          <unset token="form.premise_id_field"></unset>

        </condition>
      </change>
    </input>
    <input type="multiselect" token="premise_id_field" searchWhenChanged="true" depends="$displaypremise$">
      <label>Enter a Premise ID</label>
      <fieldForLabel>premiseid</fieldForLabel>
      <fieldForValue>premiseid</fieldForValue>
      <search>
        <query>index="blah_camera_status" sourcetype=access_combined_blah_camerastatus |rex  "Premise=\s+(?<premiseid>\d+)"|dedup premiseid</query>
        <earliest>$time_field1.earliest$</earliest>
        <latest>$time_field1.latest$</latest>
      </search>
      <delimiter> </delimiter>
      <change>
        <set token="panelyes"></set>
      </change>
    </input>
    <input type="multiselect" token="premise_id_field" searchWhenChanged="true" depends="$displaymac$">
      <label>Enter a MAC ID</label>
      <fieldForLabel>premiseid</fieldForLabel>
      <fieldForValue>premiseid</fieldForValue>
      <search>
        <query>index="blah_camera_status" sourcetype=access_combined_blah_camerastatus |rex max_match=0 "Mac=\s+(?<premiseid>[a-fA-F0-9\.:-]{12,17})"|mvexpand premiseid|dedup premiseid</query>
        <earliest>$time_field1.earliest$</earliest>
        <latest>$time_field1.latest$</latest>
      </search>
      <delimiter> </delimiter>
      <change>
        <set token="panelyes"></set>
      </change>
    </input>
 </fieldset>

[rlalwani_splunk]

You can set a token on the change event of the multiselect input and then use that token in the other input.
So by default you can set two tokens in both the multiselect inputs to Show both the inputs on load of the dashboard and when the change event of any multiselect input happens, you unset the token of the other input.
So when a user selects a Premise ID you unset the Mac ID token and vice versa.

Something like below:

For Premise ID Input
In the multiselect input you add the depends attribute and set its value to the token

<input type="multiselect" token="premise_id_field" searchWhenChanged="true" depends="$Show_Premise_ID$">

On change event of Premise ID:

<unset token="Show_MAC_ID"></unset>

For Mac ID Input:

<input type="multiselect" token="premise_id_field" searchWhenChanged="true" depends="$Show_MAC_ID">

On change event of Mac ID input:

<unset token="Show_Premise_ID"></unset>

Set this token by default so both of the inputs are visible on load of the dashboard.

[dbcase]

Hi Rlalwani,

Thanks this seems elegant! However when I tried it, it does something unusual. It displays both multiselects and then hides them both almost immediately. I'm sure I'm missing something. Below is the xml, any thoughts?

<form>

  <init>
     <unset token="Show_Premise_ID"></unset>
    <unset token="Show_MAC_ID"></unset>
    <set token="Show_Premise_ID"></set>
    <set token="Show_MAC_ID"></set>

   </init>


  <label>blah Cameras</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="time_field1" searchWhenChanged="false">
      <label>Select a time period</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>

    </input>
    <input type="multiselect" token="premise_id_field" searchWhenChanged="true" depends="$Show_Premise_ID$">
      <label>Enter a Premise ID</label>
      <fieldForLabel>premiseid</fieldForLabel>
      <fieldForValue>premiseid</fieldForValue>
      <search>
        <query>index="blah_camera_status" sourcetype=access_combined_blah_camerastatus |rex  "Premise=\s+(?&lt;premiseid&gt;\d+)"|dedup premiseid</query>
        <earliest>$time_field1.earliest$</earliest>
        <latest>$time_field1.latest$</latest>
      </search>
      <delimiter> </delimiter>
      <change>
         <unset token="Show_MAC_ID"></unset>
        <set token="panelyes">1</set>
      </change>
    </input>
    <input type="multiselect" token="premise_id_field" searchWhenChanged="true" depends="$Show_MAC_ID$">
      <label>Enter a MAC ID</label>
      <fieldForLabel>macid</fieldForLabel>
      <fieldForValue>macid</fieldForValue>
      <search>
        <query>index="blah_camera_status" sourcetype=access_combined_blah_camerastatus |rex max_match=0 "Mac=\s+(?&lt;macid&gt;[a-fA-F0-9\.:-]{12,17})"|mvexpand macid|dedup macid</query>
        <earliest>$time_field1.earliest$</earliest>
        <latest>$time_field1.latest$</latest>
      </search>
      <delimiter> </delimiter>
      <change>
        <unset token="Show_Premise_ID"></unset>
        <set token="panelyes">1</set>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$panelyes$">
      <title>Camera List for $premise_id_field$</title>
      <table>
        <search>
          <query>index="blah_camera_status" sourcetype=access_combined_blah_camerastatus $premise_id_field$  |rex max_match=0 "Premise=\s+(?&lt;premiseid&gt;\d+)"|rex max_match=0 "Name=\s+(?&lt;cname&gt;.+)"|rex max_match=0 "Mac=\s+(?&lt;macid&gt;[a-fA-F0-9\.:-]{12,17})"|rex max_match=0 "RSSI=\s+(?&lt;rssiid&gt;[^\s]+)"|rex max_match=0 "Model=\s+(?&lt;cmodel&gt;.+)"|dedup macid|eval temp=mvzip(mvzip(mvzip(macid,rssiid,"###"),cmodel,"###"),cname,"###")|mvexpand temp | rex field=temp "(?&lt;macid&gt;.+)###(?&lt;rssiid&gt;.+)###(?&lt;cmodel&gt;.+)###(?&lt;cname&gt;.+)"|eval rssiid=if(cmodel="iCamera2-C" AND rssiid!=0, rssiid+-20,rssiid)|eval rssiid=if(rssiid="dB",0,rssiid)|stats list(cname) as "Camera Name" list(macid) as MAC, list(cmodel) as "Camera Model" count(macid) as "Number of Cameras", list(rssiid) as RSSI  by premiseid|sort premiseid RSSI|rename RSSI as "Current RSSI"|rename premiseid as "PREMISE"</query>
          <earliest>$time_field1.earliest$</earliest>
          <latest>$time_field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">5</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$panelyes$">
      <title>RSSI values by camera for $premise_id_field$</title>
      <chart>
        <search>
          <query>index="blah_camera_status" sourcetype=access_combined_blah_camerastatus $premise_id_field$|rex max_match=0 "Premise=\s+(?&lt;premiseid&gt;\d+)"|rex max_match=0 "Mac=\s+(?&lt;macid&gt;[a-fA-F0-9\.:-]{12,17})"|rex max_match=0 "RSSI=\s+(?&lt;rssiid&gt;[^\s]+)"|rex max_match=0 "Model=\s+(?&lt;cmodel&gt;.+)"|eval rssiid=if((cmodel="iCamera2-C") OR (rssiid=0),rssiid,rssiid+-20)| eval temp=mvzip(mvzip(macid,rssiid,"###"),cmodel,"###")|mvexpand temp | rex field=temp "(?&lt;macid&gt;.+)###(?&lt;rssiid&gt;.+)###(?&lt;cmodel&gt;.+)"|eval rssiid=if(cmodel="iCamera2-C" AND rssiid!=0, rssiid+-20,rssiid)|eval rssiid=if(rssiid="dB",0,rssiid)
 |timechart span=1hr values(rssiid) as RSSI by macid</query>
          <earliest>$time_field1.earliest$</earliest>
          <latest>$time_field1.latest$</latest>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">connect</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">none</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trellis.splitBy">macid</option>
      </chart>
    </panel>
  </row>
</form>