topic Form with a multi-value text box that will OR every input values in Getting Data In

Form with a multi-value text box that will OR every input values

harish_ka — Mon, 13 Jun 2016 14:59:56 GMT

How to search multiple values in a text box, that should return results for all the input values.
For Ex, i have a textbox named Num in dashboard, now i can search only 1 input value,
How can i search multiple values, so that i can enter like 10,12,33 , which returns all 3 input results.
The textbox should accept the values like (Num=10 OR Num=12 OR Num=33)

Re: Form with a multi-value text box that will OR every input values

sundareshr — Mon, 13 Jun 2016 15:21:31 GMT

https://answers.splunk.com/answers/127021/manipulate-a-token-string-in-a-form.html

Re: Form with a multi-value text box that will OR every input values

gjones_splunk — Wed, 30 Sep 2020 02:43:16 GMT

Hi there,

Bit late in answering (but in case anyone has the same question) I had a bit of help from a colleague on this and it works a treat. Use this xml in a dashboard (against index=_internal) to get an idea of how it works.

Text Input Multi-value Filter

<input type="time" token="TimePicker">
  <label>Time Picker</label>
  <default>
    <earliest>-60m@m</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="text" token="Text_Input">
  <label>Sourcetype text filter with "," separator. It also uses the rex command in the search so you don't have to worry about spaces.</label>
  <prefix>"</prefix>
  <suffix>"</suffix>
</input>


<panel>
  <title>Example of events dedup'd by sourcetype</title>
  <table>
    <search>
      <query>index=_internal

index=_internal
| stats values(sourcetype)
$TimePicker.earliest$
$TimePicker.latest$

none