Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to get a multiselect form input to pass two types of values?

$
0
0
When creating a search using pivot/data model, I can add a filter that looks something like: FILTER Brand in (brand1,brand2,brand3) or FILTER Brand in (*) as default value When running a regular search to filter by brand, the search would need to look something like: search (Brand=brand1 OR Brand=brand3 OR Brand=brand3) In my dashboard, I have a bunch of panels that use the pivot/data model. I also have multiple multiselect filters (that are dependent on another) for the dashboard that currently use pivot, but to make things run a little faster, I would like to use regular searches to populate the multiselect filter values. Is there a way to pull the token value of the multiselect form which is delimited by `,`, pass it into another token, and replace the comma delimiter with a new one, which would be ` OR Brand=`? For example, if the multiselect form is currently set up to pass value as `(brand1,brand2,brand3)`, I would like to copy this token value and pass it into a new token value as `(Brand=brand1 OR Brand=brand2 OR Brand=brand3)` thanks ahead of time.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>