Dashboards & Visualizations

Using EventHandler with MultiSelectInput

tdiestel
Path Finder

I have a multiselect input and i want to create a couple tokens from a single multiselect. This works with single value inputs but for Multiselects inputs it fails.

Here's the scenario: I have a table like this,
name| state | city
tom| CA | SF
mike|CA |TAHOE
mark|AZ | Phoenix

In the multi select you can select from a list of names and the token will be the states. BUT I also want to create a token for the city at the same time. I tried this:

    var input2 = new MultiSelectInput({
        "id": "input2",
        "delimiter": " ",
        "labelField": "name",
        "searchWhenChanged": true,
        "valueField": "state",
        "value": "$form.multi_select2$",
        "managerid": "search5",
        "el": $('#input2')
    }, {tokens: true}).render();

    input2.on("change", function(newValue) {
        FormUtils.handleValueChange(input2);
    });


   input2.on("valueChange", function(e) {
       if (e.value !== undefined) {
           EventHandler.setToken("field2.cityMultiSelect", "$row.city$", {}, e.data);
       }
   });

When I try the above code it will only populate the $field2.cityMultiSelect$ with one city value, even though the user may have selected multiple names. Is there any what to make $field2.cityMultiSelect$ a multi value token as well?

Tags (3)

niketn
Legend

@tdiestel, Since the multiselect value just assigns the first selected value as token and ignores the remaining selected multivalues.
alt text

Following JavaScript can be used to iterate through the multi values and return selected comma separated values.
PS: The example is from HTML Dashboard, but the same can be modified for SplunkJS as well.

    input2.on("valueChange", function(e) {
        var loopCounter;
        for(loopCounter=0;loopCounter<e.data.length;loopCounter++)
        {
            var tmpMultiValue;
            if (e.value[loopCounter] !== undefined) {
                if(tmpMultiValue == undefined){
                    // First time initialize temporary multivalued data
                    tmpMultiValue=e.value[loopCounter];
                }else{
                    // Prepare comma separated multivalued data
                    tmpMultiValue=tmpMultiValue+","+e.value[loopCounter];
                    // Original code untouched. 
                    // Sets first value. If iterated over data objects (cumulative) this might populate multivalued data.
                    EventHandler.setToken("multiSelect", "$value$", {}, e.data);
                }
          }
        }
        // Custom multi valued token multiValue set using SplunkJS Token Handler.
        // May need to change from default to submitted Token handler as required.
        var tokens = mvc.Components.get("default");
        tokens.set("multiValue", tmpMultiValue);
    });

Once multiValue token is populated the same can be passed to a dummy Splunk Search to iterate and split as multi valued using comma and then expanded as single value results.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

The change event is not available for multiselect input refer to the documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference

I wish there was an enhancement to multiselect input to handle change.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

tdiestel
Path Finder

This is very helpful. One thing I don't understand is why would it not be available for the multiselect, but available for the check box, where you can have several options?

I'll test this out and see if it works as i would expect the multiselect to work. Thank you again.

UPDATE: Just tested out the check box input and same results as the multiselect, which is it doesn't work.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...