topic Re: Creating "Custom groups" and using them in a filter in Getting Data In

Creating "Custom groups" and using them in a filter

andreafebbo — Fri, 13 Jan 2017 11:25:36 GMT

I would like to do on splunk something similar to what in microstrategy is colled custom groups.

I'll try to explain it as simply as I can.

I have a field i use in a multiple selection filters.

ex: colours - yellow red white black blue etc...

This list of colours is VERY long, so it's quite uncomfortable for the users select in the multiple selection filters which colours he needs.

so id like to create a group of colours called "beauty" in which I specify which colour is beautiful e which is not.

ex:
beautiful colours: red blue green
ugly colours: all others

I'd like to do this outside of the single dashboard so i can use this for filtering in many dashboards.

Before reinventing the wheel I wanted to be sure there are not known solutions.

If there are not which ones you suggest.

Thanks a lot.

Re: Creating "Custom groups" and using them in a filter

cmerriman — Fri, 13 Jan 2017 12:34:02 GMT

you can create a tag for this. then you can create a token in the dashboard for the tag

https://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Defineandusetags

but with multiple colors per tag, you might want to create an event type first and assign that event type to the tag

http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Defineeventtypes#Save_a_search_as_a_new_event_type

Re: Creating "Custom groups" and using them in a filter

cmerriman — Fri, 13 Jan 2017 12:43:29 GMT

as a for instance, you could have an eventtype called beauty, the search string would just be color=Red OR color=Blue OR color=Green Tag(s) could be called beauty. save that off. then create a tag by tag name. tag name could be called beauty and field value pair would be eventtype=beauty

Re: Creating "Custom groups" and using them in a filter

andreafebbo — Mon, 16 Jan 2017 11:26:03 GMT

I solved everything with an eventype.
Thank you!