<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to split token value and search new values in a lookup table? in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-split-token-value-and-search-new-values-in-a-lookup-table/m-p/457027#M29994</link>
    <description>&lt;P&gt;Thanks you so much for your answer, that worked! &lt;BR /&gt;
I have one last question.&lt;/P&gt;

&lt;P&gt;Would it be possible to detect if there is a space between the server name and make the search still work.&lt;/P&gt;

&lt;P&gt;For example:&lt;BR /&gt;
server1, server2, server3, server4&lt;/P&gt;

&lt;P&gt;Thank you&lt;/P&gt;</description>
    <pubDate>Thu, 13 Sep 2018 07:55:55 GMT</pubDate>
    <dc:creator>baty0</dc:creator>
    <dc:date>2018-09-13T07:55:55Z</dc:date>
    <item>
      <title>How to split token value and search new values in a lookup table?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-split-token-value-and-search-new-values-in-a-lookup-table/m-p/457025#M29992</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;On a dashboard, in a text field box, I would like to be able to give a list of servers in the following format:&lt;/P&gt;

&lt;P&gt;server1,server2,server3,server4 etc...&lt;/P&gt;

&lt;P&gt;Is it possible to split this list, do a search on a lookuptable and return information for these servers?&lt;/P&gt;

&lt;P&gt;For example, the search would be:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;|inputlookup ServerInfo.csv
|search HostName=server1 OR HostName=server2 OR HostName=server3 OR HostName=server4
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I hope that makes sense&lt;/P&gt;

&lt;P&gt;Thanks&lt;/P&gt;</description>
      <pubDate>Thu, 13 Sep 2018 07:07:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-split-token-value-and-search-new-values-in-a-lookup-table/m-p/457025#M29992</guid>
      <dc:creator>baty0</dc:creator>
      <dc:date>2018-09-13T07:07:15Z</dc:date>
    </item>
    <item>
      <title>Re: How to split token value and search new values in a lookup table?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-split-token-value-and-search-new-values-in-a-lookup-table/m-p/457026#M29993</link>
      <description>&lt;P&gt;@baty0 ,&lt;BR /&gt;
Try below. You need to change the html panel to adapt your dashboard panels.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;form&amp;gt;
  &amp;lt;label&amp;gt;Token Split&amp;lt;/label&amp;gt;
  &amp;lt;fieldset submitButton="false"&amp;gt;
    &amp;lt;input type="text" token="server_names"&amp;gt;
      &amp;lt;label&amp;gt;Server Name&amp;lt;/label&amp;gt;
      &amp;lt;change&amp;gt;
        &amp;lt;eval token="splitted_search"&amp;gt;"(hostname=\"".mvjoin(split(replace($value$," ",""),","),"\" OR hostname=\"")."\")"&amp;lt;/eval&amp;gt;
      &amp;lt;/change&amp;gt;
    &amp;lt;/input&amp;gt;
  &amp;lt;/fieldset&amp;gt;
  &amp;lt;row&amp;gt;
    &amp;lt;html&amp;gt;
      &amp;lt;h1&amp;gt;|inputlookup ServerInfo.csv|search $splitted_search$&amp;lt;/h1&amp;gt;
    &amp;lt;/html&amp;gt;
  &amp;lt;/row&amp;gt;
&amp;lt;/form&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 13 Sep 2018 07:29:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-split-token-value-and-search-new-values-in-a-lookup-table/m-p/457026#M29993</guid>
      <dc:creator>renjith_nair</dc:creator>
      <dc:date>2018-09-13T07:29:53Z</dc:date>
    </item>
    <item>
      <title>Re: How to split token value and search new values in a lookup table?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-split-token-value-and-search-new-values-in-a-lookup-table/m-p/457027#M29994</link>
      <description>&lt;P&gt;Thanks you so much for your answer, that worked! &lt;BR /&gt;
I have one last question.&lt;/P&gt;

&lt;P&gt;Would it be possible to detect if there is a space between the server name and make the search still work.&lt;/P&gt;

&lt;P&gt;For example:&lt;BR /&gt;
server1, server2, server3, server4&lt;/P&gt;

&lt;P&gt;Thank you&lt;/P&gt;</description>
      <pubDate>Thu, 13 Sep 2018 07:55:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-split-token-value-and-search-new-values-in-a-lookup-table/m-p/457027#M29994</guid>
      <dc:creator>baty0</dc:creator>
      <dc:date>2018-09-13T07:55:55Z</dc:date>
    </item>
    <item>
      <title>Re: How to split token value and search new values in a lookup table?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-split-token-value-and-search-new-values-in-a-lookup-table/m-p/457028#M29995</link>
      <description>&lt;P&gt;you shall remove the space, Please use below&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;"(hostname=\"".mvjoin(split(replace($value$," ",""),","),"\" OR hostname=\"")."\")"
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Updated the answer with the change. Please upvote if it helps!&lt;/P&gt;</description>
      <pubDate>Thu, 13 Sep 2018 08:28:05 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-split-token-value-and-search-new-values-in-a-lookup-table/m-p/457028#M29995</guid>
      <dc:creator>renjith_nair</dc:creator>
      <dc:date>2018-09-13T08:28:05Z</dc:date>
    </item>
    <item>
      <title>Re: How to split token value and search new values in a lookup table?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-split-token-value-and-search-new-values-in-a-lookup-table/m-p/457029#M29996</link>
      <description>&lt;P&gt;You're a legend! Thanks&lt;/P&gt;</description>
      <pubDate>Thu, 13 Sep 2018 23:41:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-split-token-value-and-search-new-values-in-a-lookup-table/m-p/457029#M29996</guid>
      <dc:creator>baty0</dc:creator>
      <dc:date>2018-09-13T23:41:29Z</dc:date>
    </item>
  </channel>
</rss>

