my workaround at this time ist to use the EVAL funtion to add a prefix and suffix to each result of the search that fills the multiselect input. for example result from search: Red Hat Local Security Checks manipulatet reasult: "Red Hat Local Security Checks"     | eval fam="\"".fam."\""   now multislect is realy only space seperated between the inputs from search (search results). only disadvantage is the optical point in the dropdown (the suffix and prefix ")   ... View more

This was from my Source (Dashboard Editor -> Source [</>] The question is how can i modify / format the input for the multiselct / IN function? If i understand this example Multiselect - Splunk Documentation  "context": { "formattedConfig": { "number": { "prefix": "" } }, "formattedStatics": ">statics | formatByType(formattedConfig)", "statics": [ [ "All" ], [ "*" ] ], "label": ">primary | seriesByName(\"sourcetype\") | renameSeries(\"label\") | formatByType(formattedConfig)", "value": ">primary | seriesByName(\"sourcetype\") | renameSeries(\"value\") | formatByType(formattedConfig)" } the solution is in the "context" area.   ... View more

as i understood, the multiselect from the dashboard studio uses by default  The only supported multiselect input delimiter is the comma use inputs and tokens to make dashboards dynamic - Splunk Documentation) my code xml   "input_ian7EbEx": { "options": { "items": [ { "label": "All", "value": "***" } ], "defaultValue": "***", "token": "ms_X9Rhybia" }, "title": "Search Grade", "type": "input.multiselect", "dataSources": { "primary": "ds_FY8oki8Y" } },   the search ds_FY8oki8Y retuns one column "grade" with some values   | fillnull value="Not tested" grade | fields grade | dedup grade | sort + grade   returned values:  1 A 2 A+ 3 A- 4 B+ 5 C 6 C+ 7 F 8 N 9 Not tested   ... View more

After using this token modifier, i can only choose one value from the multiselect field (and than it is no multiselect anymore) ... View more