<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Using Multiple Values for a Single Choice in  a DropDown Input in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Using-Multiple-Values-for-a-Single-Choice-in-a-DropDown-Input/m-p/147530#M30031</link>
    <description>&lt;P&gt;Hi!&lt;/P&gt;

&lt;P&gt;Is there something like a field "status" and you use this choice as: status=$status$ in your corresponding search? If so, you could put something like this in as value:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; &amp;lt;label&amp;gt;Select a status:&amp;lt;/label&amp;gt;
&amp;lt;default&amp;gt;status=*&amp;lt;/default&amp;gt;
&amp;lt;choice value="status=*"&amp;gt;All&amp;lt;/choice&amp;gt;
&amp;lt;choice value="status=SUCCESS"&amp;gt;SUCCESS&amp;lt;/choice&amp;gt;
&amp;lt;choice value="status=FAILED OR status=FAIL OR status=FAILURE"&amp;gt;FAILURE&amp;lt;/choice&amp;gt;
&amp;lt;/input&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;and in your search you do not use status=$status$, instead you just use $status$.&lt;/P&gt;

&lt;P&gt;Greetings&lt;/P&gt;

&lt;P&gt;Tom&lt;/P&gt;</description>
    <pubDate>Thu, 02 Oct 2014 11:45:11 GMT</pubDate>
    <dc:creator>tom_frotscher</dc:creator>
    <dc:date>2014-10-02T11:45:11Z</dc:date>
    <item>
      <title>Using Multiple Values for a Single Choice in  a DropDown Input</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Using-Multiple-Values-for-a-Single-Choice-in-a-DropDown-Input/m-p/147529#M30030</link>
      <description>&lt;P&gt;Hi All,&lt;/P&gt;

&lt;P&gt;Is there a way to add multiple values in a drop down to a single choice?  For example, I have a drop down with multiple values which really should be under the same status.  Here is my example below:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;        &amp;lt;label&amp;gt;Select a status:&amp;lt;/label&amp;gt;
        &amp;lt;default&amp;gt;*&amp;lt;/default&amp;gt;
        &amp;lt;choice value="*"&amp;gt;All&amp;lt;/choice&amp;gt;
        &amp;lt;choice value="SUCCESS"&amp;gt;SUCCESS&amp;lt;/choice&amp;gt;
        &amp;lt;choice value="FAILED"&amp;gt;FAILURE&amp;lt;/choice&amp;gt;
        &amp;lt;choice value="FAIL"&amp;gt;FAILURE&amp;lt;/choice&amp;gt;
        &amp;lt;choice value="FAILURE"&amp;gt;FAILURE&amp;lt;/choice&amp;gt;
    &amp;lt;/input&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Is there a way to combine the three failures so that they all fall under "FAILURE"?&lt;/P&gt;

&lt;P&gt;Thanks in advance!&lt;/P&gt;</description>
      <pubDate>Wed, 01 Oct 2014 14:34:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Using-Multiple-Values-for-a-Single-Choice-in-a-DropDown-Input/m-p/147529#M30030</guid>
      <dc:creator>_gkollias</dc:creator>
      <dc:date>2014-10-01T14:34:26Z</dc:date>
    </item>
    <item>
      <title>Re: Using Multiple Values for a Single Choice in  a DropDown Input</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Using-Multiple-Values-for-a-Single-Choice-in-a-DropDown-Input/m-p/147530#M30031</link>
      <description>&lt;P&gt;Hi!&lt;/P&gt;

&lt;P&gt;Is there something like a field "status" and you use this choice as: status=$status$ in your corresponding search? If so, you could put something like this in as value:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; &amp;lt;label&amp;gt;Select a status:&amp;lt;/label&amp;gt;
&amp;lt;default&amp;gt;status=*&amp;lt;/default&amp;gt;
&amp;lt;choice value="status=*"&amp;gt;All&amp;lt;/choice&amp;gt;
&amp;lt;choice value="status=SUCCESS"&amp;gt;SUCCESS&amp;lt;/choice&amp;gt;
&amp;lt;choice value="status=FAILED OR status=FAIL OR status=FAILURE"&amp;gt;FAILURE&amp;lt;/choice&amp;gt;
&amp;lt;/input&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;and in your search you do not use status=$status$, instead you just use $status$.&lt;/P&gt;

&lt;P&gt;Greetings&lt;/P&gt;

&lt;P&gt;Tom&lt;/P&gt;</description>
      <pubDate>Thu, 02 Oct 2014 11:45:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Using-Multiple-Values-for-a-Single-Choice-in-a-DropDown-Input/m-p/147530#M30031</guid>
      <dc:creator>tom_frotscher</dc:creator>
      <dc:date>2014-10-02T11:45:11Z</dc:date>
    </item>
  </channel>
</rss>

