<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to search for specific values that have similar value in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-search-for-specific-values-that-have-similar-value/m-p/660021#M111609</link>
    <description>&lt;P class="lia-align-left"&gt;Just find all events with system_id=aa-1* initially (to limit the number of events you're working with) and then use then regex command to limit the values only to aa-1(-.*)?&lt;/P&gt;</description>
    <pubDate>Fri, 06 Oct 2023 17:23:09 GMT</pubDate>
    <dc:creator>PickleRick</dc:creator>
    <dc:date>2023-10-06T17:23:09Z</dc:date>
    <item>
      <title>How to search for specific values that have similar value</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-search-for-specific-values-that-have-similar-value/m-p/659455#M111552</link>
      <description>&lt;P&gt;For example,&lt;/P&gt;
&lt;P&gt;system_id = AA-1, AA-1-a, AA-1-b,&amp;nbsp; AA-10, AA-10-a, AA-10-b, AA-12, AA-12-a, AA-12-b,,, and so on.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Notice all the system_id starts with common 'AA-1' and * afterward. However, when use it as a token, as you've already feel the problem, AA-10* would return ALL the following id's start with AA-10* and nothing else, so good. however, if I choose AA-1*, not only it returns the values that start with AA-1 but also AA-10 and AA-12, which I do not want. Trying to make this a dashboard, dropdown with token, where user pikc AA-1, and it only returns ALL the values that only ahs AA-1, aa-1-a, aa-1-b and so on.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;hope this question makes sense. has anyone fix such issue before?&lt;/P&gt;</description>
      <pubDate>Tue, 03 Oct 2023 21:17:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-search-for-specific-values-that-have-similar-value/m-p/659455#M111552</guid>
      <dc:creator>yohhpark</dc:creator>
      <dc:date>2023-10-03T21:17:12Z</dc:date>
    </item>
    <item>
      <title>Re: How to search for specific values that have similar value</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-search-for-specific-values-that-have-similar-value/m-p/660020#M111608</link>
      <description>&lt;P&gt;I was able to get things to work with &lt;A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Makeresults" target="_self"&gt;makeresults&lt;/A&gt; and a mocked up Dashboard.&amp;nbsp; How does this work for you on your end:&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;form version="1.1" theme="dark"&amp;gt;
  &amp;lt;label&amp;gt;Test Dashboard&amp;lt;/label&amp;gt;
  &amp;lt;fieldset submitButton="false"&amp;gt;
    &amp;lt;input type="dropdown" token="system_id" searchWhenChanged="true"&amp;gt;
      &amp;lt;label&amp;gt;system_id&amp;lt;/label&amp;gt;
      &amp;lt;choice value="*"&amp;gt;*&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="AA-1"&amp;gt;AA-1&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="AA-2"&amp;gt;AA-2&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="AA-10"&amp;gt;AA-10&amp;lt;/choice&amp;gt;
      &amp;lt;initialValue&amp;gt;*&amp;lt;/initialValue&amp;gt;
      &amp;lt;default&amp;gt;*&amp;lt;/default&amp;gt;
    &amp;lt;/input&amp;gt;
  &amp;lt;/fieldset&amp;gt;
  &amp;lt;row&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| makeresults format="json" data="[{\"system_id\":\"AA-1\"}, {\"system_id\":\"AA-2\"}, {\"system_id\":\"AA-10\"}, {\"system_id\":\"AA-15\"}, {\"system_id\":\"AA-1\"}, {\"system_id\":\"AA-123\"}, {\"system_id\":\"aa-1-a\"}]" , {\"system_id\":\"aa-1-b\"} | search system_id="$system_id$"&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;-24h@h&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
          &amp;lt;sampleRatio&amp;gt;1&amp;lt;/sampleRatio&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;option name="count"&amp;gt;20&amp;lt;/option&amp;gt;
        &amp;lt;option name="dataOverlayMode"&amp;gt;none&amp;lt;/option&amp;gt;
        &amp;lt;option name="drilldown"&amp;gt;none&amp;lt;/option&amp;gt;
        &amp;lt;option name="percentagesRow"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="rowNumbers"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="totalsRow"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="wrap"&amp;gt;true&amp;lt;/option&amp;gt;
      &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
  &amp;lt;/row&amp;gt;
&amp;lt;/form&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 06 Oct 2023 17:18:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-search-for-specific-values-that-have-similar-value/m-p/660020#M111608</guid>
      <dc:creator>_JP</dc:creator>
      <dc:date>2023-10-06T17:18:14Z</dc:date>
    </item>
    <item>
      <title>Re: How to search for specific values that have similar value</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-search-for-specific-values-that-have-similar-value/m-p/660021#M111609</link>
      <description>&lt;P class="lia-align-left"&gt;Just find all events with system_id=aa-1* initially (to limit the number of events you're working with) and then use then regex command to limit the values only to aa-1(-.*)?&lt;/P&gt;</description>
      <pubDate>Fri, 06 Oct 2023 17:23:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-search-for-specific-values-that-have-similar-value/m-p/660021#M111609</guid>
      <dc:creator>PickleRick</dc:creator>
      <dc:date>2023-10-06T17:23:09Z</dc:date>
    </item>
  </channel>
</rss>

