<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to filter the data of lookup based on the drop-down values in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532505#M36227</link>
    <description>&lt;LI-CODE lang="markup"&gt;&amp;lt;choice value="true()"&amp;gt;All&amp;lt;/choice&amp;gt;
&amp;lt;choice value="like(parent_chain, \"%BLAZE%\")"&amp;gt;BLAZE&amp;lt;/choice&amp;gt;
&amp;lt;choice value="like(parent_chain, \"%Oneforce%\")"&amp;gt;Oneforce&amp;lt;/choice&amp;gt;
&amp;lt;choice value="like(parent_chain, \"%MerchantForce%\")"&amp;gt;MerchantForce&amp;lt;/choice&amp;gt;
&amp;lt;choice value="like(parent_chain, \"%MDT%\")"&amp;gt;MDT&amp;lt;/choice&amp;gt;
&amp;lt;choice value="like(parent_chain, \"%ConsumerForce%\")"&amp;gt;ConsumerForce&amp;lt;/choice&amp;gt;
&amp;lt;choice value="like(parent_chain, \"%Mkt-Auto%\")"&amp;gt;Mkt-Auto&amp;lt;/choice&amp;gt;
&amp;lt;choice value="like(parent_chain, \"%MarketingForce%\")"&amp;gt;MarketingForce&amp;lt;/choice&amp;gt;
&amp;lt;choice value="like(parent_chain, \"%PremiumProductPlatform%\")"&amp;gt;PremiumProductPlatform&amp;lt;/choice&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;and&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;prefix&amp;gt;(&amp;lt;/prefix&amp;gt;
&amp;lt;delimiter&amp;gt; OR &amp;lt;/delimiter&amp;gt;
&amp;lt;suffix&amp;gt;)&amp;lt;/suffix&amp;gt;&lt;/LI-CODE&gt;</description>
    <pubDate>Wed, 09 Dec 2020 17:46:38 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2020-12-09T17:46:38Z</dc:date>
    <item>
      <title>How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/529457#M35933</link>
      <description>&lt;P&gt;Hi Everyone,&lt;/P&gt;&lt;P&gt;I have one drop -down in the dashboard .Below is code for the drop-down.&lt;/P&gt;&lt;P&gt;&amp;lt;input type="multiselect" token="Teams" searchWhenChanged="true"&amp;gt;&lt;BR /&gt;&amp;lt;label&amp;gt;Teams&amp;lt;/label&amp;gt;&lt;BR /&gt;&amp;lt;choice value="*"&amp;gt;All&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="Force"&amp;gt;Force&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="Blaz"&amp;gt;BLAZ&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="OneForce"&amp;gt;Oneforce&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="Auto"&amp;gt;Auto&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;fieldForLabel&amp;gt;Teams&amp;lt;/fieldForLabel&amp;gt;&lt;BR /&gt;&amp;lt;prefix&amp;gt;(&amp;lt;/prefix&amp;gt;&lt;BR /&gt;&amp;lt;valuePrefix&amp;gt;Teams ="&amp;lt;/valuePrefix&amp;gt;&lt;BR /&gt;&amp;lt;valueSuffix&amp;gt;"&amp;lt;/valueSuffix&amp;gt;&lt;BR /&gt;&amp;lt;delimiter&amp;gt; OR &amp;lt;/delimiter&amp;gt;&lt;BR /&gt;&amp;lt;suffix&amp;gt;)&amp;lt;/suffix&amp;gt;&lt;BR /&gt;&amp;lt;initialValue&amp;gt;*&amp;lt;/initialValue&amp;gt;&lt;BR /&gt;&amp;lt;default&amp;gt;*&amp;lt;/default&amp;gt;&lt;BR /&gt;&amp;lt;/input&amp;gt;&lt;/P&gt;&lt;P&gt;I have one panel in same dashboard which is showing below fields. URL and Parent chain and many other fields.&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;URL&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &lt;STRONG&gt;PARENT CHAIN&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;1)&amp;nbsp; https:/abcd/process-groups/&amp;nbsp; &amp;nbsp; &amp;nbsp; &lt;STRONG&gt;MAIN--&amp;gt;root--&amp;gt;BLAZ - E1--&amp;gt;Blaz Transformation - Data Ingestion&lt;/STRONG&gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;2)https:/abc/process-groups/&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;STRONG&gt;MAIN--&amp;gt;root--&amp;gt;BLAZ - E3&lt;/STRONG&gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;3)https:/abc/process-groups/&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;STRONG&gt;MAIN--&amp;gt;root--&amp;gt;Oneforce--&amp;gt;FXIP&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;My parent chain is coming from inputlookup that I have highlighted. Below is the code for the query:&lt;/P&gt;&lt;P&gt;&amp;lt;row&amp;gt;&lt;BR /&gt;&amp;lt;table&amp;gt;&lt;BR /&gt;&amp;lt;search&amp;gt;&lt;BR /&gt;&amp;lt;query&amp;gt;index=abc sourcetype=xyz source="/user.log" process-groups|rename count as "Request Counts" |rex field=Request_URL "(?&amp;amp;lt;id&amp;amp;gt;[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"|stats count by Date ADS_Id Request_Type id ClickHere Request_URL|sort - ADS_Id |join type=outer id [&lt;STRONG&gt;inputlookup chains.csv&lt;/STRONG&gt;]&amp;lt;/query&amp;gt;&lt;BR /&gt;&amp;lt;earliest&amp;gt;$field1.earliest$&amp;lt;/earliest&amp;gt;&lt;BR /&gt;&amp;lt;latest&amp;gt;$field1.latest$&amp;lt;/latest&amp;gt;&lt;BR /&gt;&amp;lt;sampleRatio&amp;gt;1&amp;lt;/sampleRatio&amp;gt;&lt;BR /&gt;&amp;lt;/search&amp;gt;&lt;BR /&gt;&amp;lt;fields&amp;gt;"Date", "ADS_Id","Request_Type", "Request_URL", "id", "parent_chain"&amp;lt;/fields&amp;gt;&lt;BR /&gt;&amp;lt;option name="count"&amp;gt;100&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="dataOverlayMode"&amp;gt;none&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="drilldown"&amp;gt;cell&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="percentagesRow"&amp;gt;false&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="refresh.display"&amp;gt;progressbar&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="rowNumbers"&amp;gt;false&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="totalsRow"&amp;gt;false&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="wrap"&amp;gt;true&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;/table&amp;gt;&lt;BR /&gt;&amp;lt;/row&amp;gt;&lt;/P&gt;&lt;P&gt;I want when I select say "Blaz" from the teams drop-down then the parent chain which consists of 3rd word as&amp;nbsp; &amp;nbsp;"&lt;SPAN&gt;&lt;STRONG&gt;--&amp;gt;BLAZ&lt;/STRONG&gt;"&amp;nbsp; like :&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;&lt;STRONG&gt;MAIN--&amp;gt;root--&amp;gt;BLAZ - E1--&amp;gt;Blaz Transformation - Data Ingestion&lt;/STRONG&gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;&lt;STRONG&gt;MAIN--&amp;gt;root--&amp;gt;BLAZ - E3&lt;/STRONG&gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;when I select say Oneforce from the teams drop-down&amp;nbsp;then the parent chain which consists of 3rd word as&amp;nbsp; &amp;nbsp;"&lt;STRONG&gt;--&amp;gt;Oneforce&lt;/STRONG&gt;&lt;SPAN&gt;"&amp;nbsp; like :&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;&amp;nbsp;&lt;STRONG&gt;MAIN--&amp;gt;root--&amp;gt;Oneforce--&amp;gt;FXIP.&lt;/STRONG&gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;&lt;STRONG&gt;Can someone guide me on this.&lt;/STRONG&gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;&lt;STRONG&gt;Thanks in advance.&lt;/STRONG&gt;&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Sun, 15 Nov 2020 14:46:35 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/529457#M35933</guid>
      <dc:creator>aditsss</dc:creator>
      <dc:date>2020-11-15T14:46:35Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/529467#M35934</link>
      <description>&lt;P&gt;Can anyone please guide me on this.&lt;/P&gt;</description>
      <pubDate>Sun, 15 Nov 2020 17:32:57 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/529467#M35934</guid>
      <dc:creator>aditsss</dc:creator>
      <dc:date>2020-11-15T17:32:57Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/529495#M35936</link>
      <description>&lt;P&gt;Can someone please guide me on this.&lt;/P&gt;</description>
      <pubDate>Mon, 16 Nov 2020 06:43:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/529495#M35936</guid>
      <dc:creator>aditsss</dc:creator>
      <dc:date>2020-11-16T06:43:37Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/529511#M35938</link>
      <description>&lt;P&gt;Can someone please guide me on this please.&lt;/P&gt;&lt;P&gt;I have made some changes like this.&amp;nbsp;&lt;/P&gt;&lt;P&gt;Drop-down code:&lt;/P&gt;&lt;P&gt;&amp;lt;input type="multiselect" token="teams" searchWhenChanged="true"&amp;gt;&lt;BR /&gt;&amp;lt;label&amp;gt;Teams&amp;lt;/label&amp;gt;&lt;BR /&gt;&amp;lt;choice value="All"&amp;gt;All Teams&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="BLAZE"&amp;gt;BLAZE&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="Oneforce"&amp;gt;Oneforce&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;fieldForLabel&amp;gt;Teams&amp;lt;/fieldForLabel&amp;gt;&lt;BR /&gt;&amp;lt;prefix&amp;gt;(&amp;lt;/prefix&amp;gt;&lt;BR /&gt;&amp;lt;valuePrefix&amp;gt;Teams ="&amp;lt;/valuePrefix&amp;gt;&lt;BR /&gt;&amp;lt;valueSuffix&amp;gt;"&amp;lt;/valueSuffix&amp;gt;&lt;BR /&gt;&amp;lt;delimiter&amp;gt; OR &amp;lt;/delimiter&amp;gt;&lt;BR /&gt;&amp;lt;suffix&amp;gt;)&amp;lt;/suffix&amp;gt;&lt;BR /&gt;&amp;lt;initialValue&amp;gt;All&amp;lt;/initialValue&amp;gt;&lt;BR /&gt;&amp;lt;default&amp;gt;All&amp;lt;/default&amp;gt;&lt;BR /&gt;&amp;lt;change&amp;gt;&lt;BR /&gt;&lt;STRONG&gt;&amp;lt;eval token="form.teams"&amp;gt;case(mvcount('form.teams')=0,"All",mvcount('form.teams')&amp;amp;gt;1 AND mvfind('form.teams',"All")&amp;amp;gt;0,"All",mvcount('form.teams')&amp;amp;gt;1 AND mvfind('form.teams',"All")=0,mvfilter('form.teams'!="All"),1==1,'form.teams')&amp;lt;/eval&amp;gt;&lt;/STRONG&gt;&lt;BR /&gt;&lt;STRONG&gt;&amp;lt;eval token="BLAZE"&amp;gt;if(isnull(mvfind('form.teams',"BLAZE")),mvfind('form.teams',"All"),1)&amp;lt;/eval&amp;gt;&lt;/STRONG&gt;&lt;BR /&gt;&lt;STRONG&gt;&amp;lt;eval token="Oneforce"&amp;gt;if(isnull(mvfind('form.teams',"Oneforce")),mvfind('form.teams',"All"),1)&amp;lt;/eval&amp;gt;&lt;/STRONG&gt;&lt;BR /&gt;&lt;STRONG&gt;&amp;lt;eval token="org_choice"&amp;gt;if(mvfind('form.teams',"All")=0,$teams$)&amp;lt;/eval&amp;gt;&lt;/STRONG&gt;&lt;BR /&gt;&amp;lt;/change&amp;gt;&lt;BR /&gt;&amp;lt;/input&amp;gt;&lt;/P&gt;&lt;P&gt;Query code I have passed token in the queries like this but its not working.&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;&amp;lt;row&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;table&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;search&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;query&amp;gt;index=abc sourcetype=xyz source="/user.log" process-groups &lt;STRONG&gt;$BLAZE$ OR $Oneforce$&lt;/STRONG&gt;|rename count as "Request Counts" |rex field=Request_URL "(?&amp;amp;lt;id&amp;amp;gt;[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"|stats count by Date ADS_Id Request_Type id ClickHere Request_URL|sort - ADS_Id |join type=outer id [&lt;/SPAN&gt;&lt;STRONG&gt;inputlookup chains.csv&lt;/STRONG&gt;&lt;SPAN&gt;]&amp;lt;/query&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;earliest&amp;gt;$field1.earliest$&amp;lt;/earliest&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;latest&amp;gt;$field1.latest$&amp;lt;/latest&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;sampleRatio&amp;gt;1&amp;lt;/sampleRatio&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;/search&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;fields&amp;gt;"Date", "ADS_Id","Request_Type", "Request_URL", "id", "parent_chain"&amp;lt;/fields&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;option name="count"&amp;gt;100&amp;lt;/option&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;option name="dataOverlayMode"&amp;gt;none&amp;lt;/option&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;option name="drilldown"&amp;gt;cell&amp;lt;/option&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;option name="percentagesRow"&amp;gt;false&amp;lt;/option&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;option name="refresh.display"&amp;gt;progressbar&amp;lt;/option&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;option name="rowNumbers"&amp;gt;false&amp;lt;/option&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;option name="totalsRow"&amp;gt;false&amp;lt;/option&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;option name="wrap"&amp;gt;true&amp;lt;/option&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;/table&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;/row&amp;gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Can someone please guide me on this.&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 16 Nov 2020 12:31:48 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/529511#M35938</guid>
      <dc:creator>aditsss</dc:creator>
      <dc:date>2020-11-16T12:31:48Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/529564#M35940</link>
      <description>&lt;P&gt;Someone please help me out in this .please&lt;/P&gt;</description>
      <pubDate>Mon, 16 Nov 2020 15:48:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/529564#M35940</guid>
      <dc:creator>aditsss</dc:creator>
      <dc:date>2020-11-16T15:48:47Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/529607#M35942</link>
      <description>&lt;P&gt;Shouldn't "&lt;SPAN&gt;[A_Za-z0-9]" be "[A-Za-z0-9]"?&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Is parent chain returned by the lookup or is it in your initial search events?&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 16 Nov 2020 19:18:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/529607#M35942</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2020-11-16T19:18:40Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/529611#M35944</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;The parent chain is returned by the lookup.&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;Requirement:&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;I have one dashboard which consists of drop down and panels.&lt;/P&gt;&lt;P&gt;I have one drop down as "Teams" whose code is as below:&lt;/P&gt;&lt;P&gt;&amp;lt;input type="multiselect" token="teams" searchWhenChanged="true"&amp;gt;&lt;BR /&gt;&amp;lt;label&amp;gt;Teams&amp;lt;/label&amp;gt;&lt;BR /&gt;&amp;lt;choice value="All"&amp;gt;All Teams&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="BLAZE"&amp;gt;BLAZE&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="Oneforce"&amp;gt;Oneforce&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;fieldForLabel&amp;gt;Teams&amp;lt;/fieldForLabel&amp;gt;&lt;BR /&gt;&amp;lt;prefix&amp;gt;(&amp;lt;/prefix&amp;gt;&lt;BR /&gt;&amp;lt;valuePrefix&amp;gt;Teams ="&amp;lt;/valuePrefix&amp;gt;&lt;BR /&gt;&amp;lt;valueSuffix&amp;gt;"&amp;lt;/valueSuffix&amp;gt;&lt;BR /&gt;&amp;lt;delimiter&amp;gt; OR &amp;lt;/delimiter&amp;gt;&lt;BR /&gt;&amp;lt;suffix&amp;gt;)&amp;lt;/suffix&amp;gt;&lt;BR /&gt;&amp;lt;initialValue&amp;gt;All&amp;lt;/initialValue&amp;gt;&lt;BR /&gt;&amp;lt;default&amp;gt;All&amp;lt;/default&amp;gt;&lt;BR /&gt;&amp;lt;change&amp;gt;&lt;BR /&gt;&amp;lt;eval token="form.teams"&amp;gt;case(mvcount('form.teams')=0,"All",mvcount('form.teams')&amp;amp;gt;1 AND mvfind('form.teams',"All")&amp;amp;gt;0,"All",mvcount('form.teams')&amp;amp;gt;1 AND mvfind('form.teams',"All")=0,mvfilter('form.teams'!="All"),1==1,'form.teams')&amp;lt;/eval&amp;gt;&lt;BR /&gt;&amp;lt;eval token="BLAZE"&amp;gt;if(isnull(mvfind('form.teams',"BLAZE")),mvfind('form.teams',"All"),1)&amp;lt;/eval&amp;gt;&lt;BR /&gt;&amp;lt;eval token="Oneforce"&amp;gt;if(isnull(mvfind('form.teams',"Oneforce")),mvfind('form.teams',"All"),1)&amp;lt;/eval&amp;gt;&lt;BR /&gt;&amp;lt;eval token="org_choice"&amp;gt;if(mvfind('form.teams',"All")=0,$teams$)&amp;lt;/eval&amp;gt;&lt;BR /&gt;&amp;lt;/change&amp;gt;&lt;BR /&gt;&amp;lt;/input&amp;gt;&lt;/P&gt;&lt;P&gt;I have one panel which is showing multiple fields including parent chain and parent chain is coming from inputlookup.&lt;/P&gt;&lt;P&gt;parent_chain&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;MAIN--&amp;gt;root--&amp;gt;BLAZE - E1--&amp;gt;Blaz Transformation - Data&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;MAIN--&amp;gt;root--&amp;gt;BLAZE - E3&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;MAIN--&amp;gt;root--&amp;gt;Oneforce--&amp;gt;FXIP&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;Below is the code of the panel. The parent chain is coming from&amp;nbsp;&lt;STRONG&gt;inputlookup chains.csv .&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;what I want is when I select "BLAZE" from the teams drop-down all the parent chain which consists of 3rd word as "BLAZE" should be shown .Basically the parent chain which include the word as "BLAZE" should come. Like below:&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;MAIN--&amp;gt;root--&amp;gt;BLAZE - E1--&amp;gt;Blaz Transformation - Data&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;MAIN--&amp;gt;root--&amp;gt;BLAZE - E3&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;when I select the word "Oneforce" from teams drop-down the parent chain which consists of word "Oneforce" should come like this:&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;MAIN--&amp;gt;root--&amp;gt;Oneforce--&amp;gt;FXIP&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;&lt;SPAN&gt;MAIN--&amp;gt;root--&amp;gt;Oneforce--&amp;gt;Support_Tools&lt;/SPAN&gt;&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;I have passed the tokens as&amp;nbsp;&lt;SPAN&gt;$BLAZE$ OR $Oneforce$ in query but still result is not filtering.&lt;/SPAN&gt;&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;&lt;SPAN&gt;Below is the code for it.&lt;/SPAN&gt;&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&amp;lt;row&amp;gt;&lt;BR /&gt;&amp;lt;table&amp;gt;&lt;BR /&gt;&amp;lt;search&amp;gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;lt;query&amp;gt;index=abc sourcetype=xyz source="/user.log" process-groups&amp;nbsp;&lt;STRONG&gt;$BLAZE$ OR $Oneforce$&lt;/STRONG&gt;|rename count as "Request Counts" |rex field=Request_URL "(?&amp;amp;lt;id&amp;amp;gt;[A-Za-z0-9]{8}[\-][A-Za-z0-9]{4}[\-][A-Za-z0-9]{4}[\-][A-Za-z0-9]{4}[\-][A-Za-z0-9]{12})"|stats count by Date ADS_Id Request_Type id ClickHere Request_URL|sort - ADS_Id |join type=outer id [&lt;/SPAN&gt;&lt;STRONG&gt;inputlookup chains.csv&lt;/STRONG&gt;&lt;SPAN&gt;]&amp;lt;/query&amp;gt;&lt;/SPAN&gt;&lt;BR /&gt;&amp;lt;earliest&amp;gt;$field1.earliest$&amp;lt;/earliest&amp;gt;&lt;BR /&gt;&amp;lt;latest&amp;gt;$field1.latest$&amp;lt;/latest&amp;gt;&lt;BR /&gt;&amp;lt;sampleRatio&amp;gt;1&amp;lt;/sampleRatio&amp;gt;&lt;BR /&gt;&amp;lt;/search&amp;gt;&lt;BR /&gt;&amp;lt;fields&amp;gt;"Date", "ADS_Id","Request_Type", "Request_URL", "id", "parent_chain"&amp;lt;/fields&amp;gt;&lt;BR /&gt;&amp;lt;option name="count"&amp;gt;100&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="dataOverlayMode"&amp;gt;none&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="drilldown"&amp;gt;cell&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="percentagesRow"&amp;gt;false&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="refresh.display"&amp;gt;progressbar&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="rowNumbers"&amp;gt;false&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="totalsRow"&amp;gt;false&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="wrap"&amp;gt;true&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;/table&amp;gt;&lt;BR /&gt;&amp;lt;/row&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp; please guide me. Your solutions always works for me.&lt;/P&gt;&lt;P&gt;Thanks in advance.&lt;/P&gt;</description>
      <pubDate>Mon, 16 Nov 2020 19:32:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/529611#M35944</guid>
      <dc:creator>aditsss</dc:creator>
      <dc:date>2020-11-16T19:32:47Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532016#M36173</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Your solutions always work for me. Please can you guide me on this.&lt;/P&gt;</description>
      <pubDate>Fri, 04 Dec 2020 12:58:07 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532016#M36173</guid>
      <dc:creator>aditsss</dc:creator>
      <dc:date>2020-12-04T12:58:07Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532017#M36174</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Can you please guide me on this.&lt;/P&gt;</description>
      <pubDate>Fri, 04 Dec 2020 13:11:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532017#M36174</guid>
      <dc:creator>aditsss</dc:creator>
      <dc:date>2020-12-04T13:11:54Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532066#M36182</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Can you please guide me on this.&lt;/P&gt;</description>
      <pubDate>Fri, 04 Dec 2020 19:24:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532066#M36182</guid>
      <dc:creator>aditsss</dc:creator>
      <dc:date>2020-12-04T19:24:45Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532108#M36188</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Your solutions always help me out. Can you please guide me on this.&lt;/P&gt;</description>
      <pubDate>Sat, 05 Dec 2020 18:36:58 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532108#M36188</guid>
      <dc:creator>aditsss</dc:creator>
      <dc:date>2020-12-05T18:36:58Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532111#M36190</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Please guide me on this. Your solutions are always helpful.&lt;/P&gt;</description>
      <pubDate>Sat, 05 Dec 2020 19:33:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532111#M36190</guid>
      <dc:creator>aditsss</dc:creator>
      <dc:date>2020-12-05T19:33:29Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532113#M36191</link>
      <description>&lt;P&gt;Try something like this (changed how token was formatted in your multiselect, replaced join with lookup command and used token in correct place).&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;?xml version="1.0" encoding="UTF-8"?&amp;gt;
&amp;lt;form&amp;gt;
    &amp;lt;fieldset&amp;gt;
        &amp;lt;input type="multiselect" token="Teams" searchWhenChanged="true"&amp;gt;
            &amp;lt;label&amp;gt;Teams&amp;lt;/label&amp;gt;
            &amp;lt;choice value="*"&amp;gt;All&amp;lt;/choice&amp;gt;
            &amp;lt;choice value="Force"&amp;gt;Force&amp;lt;/choice&amp;gt;
            &amp;lt;choice value="Blaz"&amp;gt;BLAZ&amp;lt;/choice&amp;gt;
            &amp;lt;choice value="OneForce"&amp;gt;Oneforce&amp;lt;/choice&amp;gt;
            &amp;lt;choice value="Auto"&amp;gt;Auto&amp;lt;/choice&amp;gt;
            &amp;lt;fieldForLabel&amp;gt;Teams&amp;lt;/fieldForLabel&amp;gt;
            &amp;lt;prefix&amp;gt;(&amp;lt;/prefix&amp;gt;
            &amp;lt;valuePrefix&amp;gt; parent_chain="*&amp;lt;/valuePrefix&amp;gt;
            &amp;lt;valueSuffix&amp;gt;*"&amp;lt;/valueSuffix&amp;gt;
            &amp;lt;delimiter&amp;gt; OR &amp;lt;/delimiter&amp;gt;
            &amp;lt;suffix&amp;gt;)&amp;lt;/suffix&amp;gt;
            &amp;lt;initialValue&amp;gt;*&amp;lt;/initialValue&amp;gt;
            &amp;lt;default&amp;gt;*&amp;lt;/default&amp;gt;
        &amp;lt;/input&amp;gt;
    &amp;lt;/fieldset&amp;gt;
    &amp;lt;row&amp;gt;
        &amp;lt;table&amp;gt;
            &amp;lt;search&amp;gt;
                &amp;lt;query&amp;gt;index=abc sourcetype=xyz source="/user.log" process-groups|rename count as "Request Counts" |rex field=Request_URL "(?&amp;amp;lt;id&amp;amp;gt;[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"|stats count by Date ADS_Id Request_Type id ClickHere Request_URL|sort - ADS_Id |lookup chains.csv id OUTPUT parent_chain | where $Teams$&amp;lt;/query&amp;gt;
                &amp;lt;earliest&amp;gt;$field1.earliest$&amp;lt;/earliest&amp;gt;
                &amp;lt;latest&amp;gt;$field1.latest$&amp;lt;/latest&amp;gt;
                &amp;lt;sampleRatio&amp;gt;1&amp;lt;/sampleRatio&amp;gt;
            &amp;lt;/search&amp;gt;
            &amp;lt;fields&amp;gt;"Date", "ADS_Id","Request_Type", "Request_URL", "id", "parent_chain"&amp;lt;/fields&amp;gt;
            &amp;lt;option name="count"&amp;gt;100&amp;lt;/option&amp;gt;
            &amp;lt;option name="dataOverlayMode"&amp;gt;none&amp;lt;/option&amp;gt;
            &amp;lt;option name="drilldown"&amp;gt;cell&amp;lt;/option&amp;gt;
            &amp;lt;option name="percentagesRow"&amp;gt;false&amp;lt;/option&amp;gt;
            &amp;lt;option name="refresh.display"&amp;gt;progressbar&amp;lt;/option&amp;gt;
            &amp;lt;option name="rowNumbers"&amp;gt;false&amp;lt;/option&amp;gt;
            &amp;lt;option name="totalsRow"&amp;gt;false&amp;lt;/option&amp;gt;
            &amp;lt;option name="wrap"&amp;gt;true&amp;lt;/option&amp;gt;
        &amp;lt;/table&amp;gt;
    &amp;lt;/row&amp;gt;
&amp;lt;/form&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Sat, 05 Dec 2020 21:07:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532113#M36191</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2020-12-05T21:07:17Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532290#M36209</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/15147"&gt;@somesoni2&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I have tried this but nothing is coming.&lt;/P&gt;&lt;P&gt;Its showing Result not found.&lt;/P&gt;&lt;P&gt;Can you let me know where I have gone wrong:&lt;/P&gt;&lt;P&gt;Multiselect code:&lt;/P&gt;&lt;P&gt;&amp;lt;input type="multiselect" token="Teams" searchWhenChanged="true"&amp;gt;&lt;BR /&gt;&amp;lt;label&amp;gt;Teams&amp;lt;/label&amp;gt;&lt;BR /&gt;&amp;lt;choice value="*"&amp;gt;All&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="BLAZE"&amp;gt;BLAZE&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="Oneforce"&amp;gt;Oneforce&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;fieldForLabel&amp;gt;Teams&amp;lt;/fieldForLabel&amp;gt;&lt;BR /&gt;&amp;lt;prefix&amp;gt;(&amp;lt;/prefix&amp;gt;&lt;BR /&gt;&amp;lt;valuePrefix&amp;gt; parent_chain="*&amp;lt;/valuePrefix&amp;gt;&lt;BR /&gt;&amp;lt;valueSuffix&amp;gt;*"&amp;lt;/valueSuffix&amp;gt;&lt;BR /&gt;&amp;lt;delimiter&amp;gt; OR &amp;lt;/delimiter&amp;gt;&lt;BR /&gt;&amp;lt;suffix&amp;gt;)&amp;lt;/suffix&amp;gt;&lt;BR /&gt;&amp;lt;initialValue&amp;gt;*&amp;lt;/initialValue&amp;gt;&lt;BR /&gt;&amp;lt;default&amp;gt;*&amp;lt;/default&amp;gt;&lt;BR /&gt;&amp;lt;/input&amp;gt;&lt;/P&gt;&lt;P&gt;My panel code from where parent chain is coming:&lt;/P&gt;&lt;P&gt;&amp;lt;row&amp;gt;&lt;BR /&gt;&amp;lt;table&amp;gt;&lt;BR /&gt;&amp;lt;search&amp;gt;&lt;BR /&gt;&amp;lt;query&amp;gt;index=abc sourcetype=xyz source="user.log" process-groups | convert timeformat="%Y-%m-%d" ctime(_time) AS Date|rename count as "Request Counts" |rex field=Request_URL "(?&amp;amp;lt;id&amp;amp;gt;[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"|stats count by Date ADS_Id Request_Type id ClickHere Request_URL|sort - ADS_Id |lookup nifi_api_parent_chains.csv id OUTPUT parent_chain | where $Teams$&amp;lt;/query&amp;gt;&lt;BR /&gt;&amp;lt;earliest&amp;gt;$field1.earliest$&amp;lt;/earliest&amp;gt;&lt;BR /&gt;&amp;lt;latest&amp;gt;$field1.latest$&amp;lt;/latest&amp;gt;&lt;BR /&gt;&amp;lt;sampleRatio&amp;gt;1&amp;lt;/sampleRatio&amp;gt;&lt;BR /&gt;&amp;lt;/search&amp;gt;&lt;BR /&gt;&amp;lt;fields&amp;gt;"Date", "ADS_Id","Request_Type", "Request_URL", "id", "parent_chain"&amp;lt;/fields&amp;gt;&lt;BR /&gt;&amp;lt;option name="count"&amp;gt;100&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="dataOverlayMode"&amp;gt;none&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="drilldown"&amp;gt;cell&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="percentagesRow"&amp;gt;false&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="refresh.display"&amp;gt;progressbar&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="rowNumbers"&amp;gt;false&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="totalsRow"&amp;gt;false&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="wrap"&amp;gt;true&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;drilldown&amp;gt;&lt;BR /&gt;&amp;lt;condition field="Request_URL"&amp;gt;&lt;BR /&gt;&amp;lt;link target="_blank"&amp;gt;$row.ClickHere|n$&amp;lt;/link&amp;gt;&lt;BR /&gt;&amp;lt;/condition&amp;gt;&lt;BR /&gt;&amp;lt;/drilldown&amp;gt;&lt;BR /&gt;&amp;lt;/table&amp;gt;&lt;BR /&gt;&amp;lt;/row&amp;gt;&lt;/P&gt;&lt;P&gt;Can you guide me on that.&lt;/P&gt;</description>
      <pubDate>Tue, 08 Dec 2020 08:30:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532290#M36209</guid>
      <dc:creator>aditsss</dc:creator>
      <dc:date>2020-12-08T08:30:44Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532386#M36219</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/15147"&gt;@somesoni2&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I have tried this but nothing is coming.&lt;/P&gt;&lt;P&gt;Its showing Result not found.&lt;/P&gt;&lt;P&gt;Can you let me know where I have gone wrong:&lt;/P&gt;&lt;P&gt;Multiselect code:&lt;/P&gt;&lt;P&gt;&amp;lt;input type="multiselect" token="Teams" searchWhenChanged="true"&amp;gt;&lt;BR /&gt;&amp;lt;label&amp;gt;Teams&amp;lt;/label&amp;gt;&lt;BR /&gt;&amp;lt;choice value="*"&amp;gt;All&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="BLAZE"&amp;gt;BLAZE&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="Oneforce"&amp;gt;Oneforce&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;fieldForLabel&amp;gt;Teams&amp;lt;/fieldForLabel&amp;gt;&lt;BR /&gt;&amp;lt;prefix&amp;gt;(&amp;lt;/prefix&amp;gt;&lt;BR /&gt;&amp;lt;valuePrefix&amp;gt; parent_chain="*&amp;lt;/valuePrefix&amp;gt;&lt;BR /&gt;&amp;lt;valueSuffix&amp;gt;*"&amp;lt;/valueSuffix&amp;gt;&lt;BR /&gt;&amp;lt;delimiter&amp;gt; OR &amp;lt;/delimiter&amp;gt;&lt;BR /&gt;&amp;lt;suffix&amp;gt;)&amp;lt;/suffix&amp;gt;&lt;BR /&gt;&amp;lt;initialValue&amp;gt;*&amp;lt;/initialValue&amp;gt;&lt;BR /&gt;&amp;lt;default&amp;gt;*&amp;lt;/default&amp;gt;&lt;BR /&gt;&amp;lt;/input&amp;gt;&lt;/P&gt;&lt;P&gt;My panel code from where parent chain is coming.&lt;/P&gt;&lt;P&gt;&amp;lt;row&amp;gt;&lt;BR /&gt;&amp;lt;table&amp;gt;&lt;BR /&gt;&amp;lt;search&amp;gt;&lt;BR /&gt;&amp;lt;query&amp;gt;index=abc sourcetype=xyz source="user.log" process-groups | convert timeformat="%Y-%m-%d" ctime(_time) AS Date|rename count as "Request Counts" |rex field=Request_URL "(?&amp;amp;lt;id&amp;amp;gt;[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"|stats count by Date ADS_Id Request_Type id ClickHere Request_URL|sort - ADS_Id |lookup nifi_api_parent_chains.csv id OUTPUT parent_chain | where $Teams$&amp;lt;/query&amp;gt;&lt;BR /&gt;&amp;lt;earliest&amp;gt;$field1.earliest$&amp;lt;/earliest&amp;gt;&lt;BR /&gt;&amp;lt;latest&amp;gt;$field1.latest$&amp;lt;/latest&amp;gt;&lt;BR /&gt;&amp;lt;sampleRatio&amp;gt;1&amp;lt;/sampleRatio&amp;gt;&lt;BR /&gt;&amp;lt;/search&amp;gt;&lt;BR /&gt;&amp;lt;fields&amp;gt;"Date", "ADS_Id","Request_Type", "Request_URL", "id", "parent_chain"&amp;lt;/fields&amp;gt;&lt;BR /&gt;&amp;lt;option name="count"&amp;gt;100&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="dataOverlayMode"&amp;gt;none&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="drilldown"&amp;gt;cell&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="percentagesRow"&amp;gt;false&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="refresh.display"&amp;gt;progressbar&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="rowNumbers"&amp;gt;false&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="totalsRow"&amp;gt;false&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="wrap"&amp;gt;true&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;drilldown&amp;gt;&lt;BR /&gt;&amp;lt;condition field="Request_URL"&amp;gt;&lt;BR /&gt;&amp;lt;link target="_blank"&amp;gt;$row.ClickHere|n$&amp;lt;/link&amp;gt;&lt;BR /&gt;&amp;lt;/condition&amp;gt;&lt;BR /&gt;&amp;lt;/drilldown&amp;gt;&lt;BR /&gt;&amp;lt;/table&amp;gt;&lt;BR /&gt;&amp;lt;/row&amp;gt;&lt;/P&gt;&lt;P&gt;Can you please guide me.&lt;/P&gt;</description>
      <pubDate>Tue, 08 Dec 2020 20:05:58 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532386#M36219</guid>
      <dc:creator>aditsss</dc:creator>
      <dc:date>2020-12-08T20:05:58Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532455#M36221</link>
      <description>&lt;P&gt;What do you get if you remove the "where $Teams$"? Do you get the results you expect just unfiltered?&lt;/P&gt;</description>
      <pubDate>Wed, 09 Dec 2020 12:09:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532455#M36221</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2020-12-09T12:09:20Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532462#M36222</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Yes I am able to get the result unfiltered. All the parent chains are coming. when I remove&amp;nbsp;&lt;STRONG&gt;where $Teams$ &lt;/STRONG&gt;from the query.&lt;/P&gt;</description>
      <pubDate>Wed, 09 Dec 2020 12:46:16 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532462#M36222</guid>
      <dc:creator>aditsss</dc:creator>
      <dc:date>2020-12-09T12:46:16Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532463#M36223</link>
      <description>&lt;P&gt;What about if you use&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| where (parent_chain="*BLAZE*")&lt;/LI-CODE&gt;</description>
      <pubDate>Wed, 09 Dec 2020 12:50:01 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532463#M36223</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2020-12-09T12:50:01Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532464#M36224</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Can you guide me is that correct I have tried something like this:&lt;/P&gt;&lt;P&gt;multiselect code:&lt;/P&gt;&lt;P&gt;&amp;lt;input type="multiselect" token="Teams" searchWhenChanged="true"&amp;gt;&lt;BR /&gt;&amp;lt;label&amp;gt;Teams&amp;lt;/label&amp;gt;&lt;BR /&gt;&amp;lt;choice value=" "&amp;gt;All&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="BLAZE"&amp;gt;BLAZE&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="Oneforce"&amp;gt;Oneforce&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="MerchantForce"&amp;gt;MerchantForce&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="MDT"&amp;gt;MDT&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="ConsumerForce"&amp;gt;ConsumerForce&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="Mkt-Auto"&amp;gt;Mkt-Auto&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="MarketingForce"&amp;gt;MarketingForce&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;choice value="PremiumProductPlatform"&amp;gt;PremiumProductPlatform&amp;lt;/choice&amp;gt;&lt;BR /&gt;&amp;lt;fieldForLabel&amp;gt;Teams&amp;lt;/fieldForLabel&amp;gt;&lt;BR /&gt;&amp;lt;valuePrefix&amp;gt;%&amp;lt;/valuePrefix&amp;gt;&lt;BR /&gt;&amp;lt;valueSuffix&amp;gt;%&amp;lt;/valueSuffix&amp;gt;&lt;BR /&gt;&amp;lt;delimiter&amp;gt; OR &amp;lt;/delimiter&amp;gt;&lt;BR /&gt;&amp;lt;initialValue&amp;gt;All&amp;lt;/initialValue&amp;gt;&lt;BR /&gt;&amp;lt;default&amp;gt;All&amp;lt;/default&amp;gt;&lt;BR /&gt;&amp;lt;/input&amp;gt;&lt;/P&gt;&lt;P&gt;panel code:&lt;/P&gt;&lt;P&gt;&amp;lt;row&amp;gt;&lt;BR /&gt;&amp;lt;table&amp;gt;&lt;BR /&gt;&amp;lt;search&amp;gt;&lt;BR /&gt;&amp;lt;query&amp;gt;index=abc sourcetype=xyz source="user.log" process-groups | convert timeformat="%Y-%m-%d" ctime(_time) AS Date|rename count as "Request Counts" |rex field=Request_URL "(?&amp;amp;lt;id&amp;amp;gt;[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"|fillnull value="" id| eval ClickHere= "&lt;A href="https://ecpnifiblaze-gso.gso.aexp.com/nifi/?processGroupId=&amp;quot;.id|stats" target="_blank" rel="noopener"&gt;https://com/abc/?processGroupId=".id|stats&lt;/A&gt; count by Date ADS_Id Request_Type id ClickHere Request_URL|sort - ADS_Id |&lt;STRONG&gt;join type=outer id [inputlookup nifi_api_parent_chains.csv]|where like(parent_chain, "$Teams$")&lt;/STRONG&gt;&amp;lt;/query&amp;gt;&lt;BR /&gt;&amp;lt;earliest&amp;gt;$field1.earliest$&amp;lt;/earliest&amp;gt;&lt;BR /&gt;&amp;lt;latest&amp;gt;$field1.latest$&amp;lt;/latest&amp;gt;&lt;BR /&gt;&amp;lt;sampleRatio&amp;gt;1&amp;lt;/sampleRatio&amp;gt;&lt;BR /&gt;&amp;lt;/search&amp;gt;&lt;BR /&gt;&amp;lt;fields&amp;gt;"Date", "ADS_Id","Request_Type", "Request_URL", "id", "parent_chain"&amp;lt;/fields&amp;gt;&lt;BR /&gt;&amp;lt;option name="count"&amp;gt;100&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="dataOverlayMode"&amp;gt;none&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="drilldown"&amp;gt;cell&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="percentagesRow"&amp;gt;false&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="refresh.display"&amp;gt;progressbar&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="rowNumbers"&amp;gt;false&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="totalsRow"&amp;gt;false&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="wrap"&amp;gt;true&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;drilldown&amp;gt;&lt;BR /&gt;&amp;lt;condition field="Request_URL"&amp;gt;&lt;BR /&gt;&amp;lt;link target="_blank"&amp;gt;$row.ClickHere|n$&amp;lt;/link&amp;gt;&lt;BR /&gt;&amp;lt;/condition&amp;gt;&lt;BR /&gt;&amp;lt;/drilldown&amp;gt;&lt;BR /&gt;&amp;lt;/table&amp;gt;&lt;BR /&gt;&amp;lt;/row&amp;gt;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;when I am selecting "BLAZE" from multiselect I am able to get the "BLAZE" result from parent chain.&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;when I am selecting "OneForce" from multiselect I am able to get the "OneForce" result from the parent chain.&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;The issue I am facing is when I am selecting both "BLAZE" and "OneForce" from multiselect its showing "NO result Found". Its only working individually.&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;Also when I am selecting "ALL" its not showing the rows which does not include the parent_chain.&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;Can you please guide me where I have gone wrong.&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;Thanks in advance.&lt;/P&gt;</description>
      <pubDate>Wed, 09 Dec 2020 13:24:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532464#M36224</guid>
      <dc:creator>aditsss</dc:creator>
      <dc:date>2020-12-09T13:24:10Z</dc:date>
    </item>
    <item>
      <title>Re: How to filter the data of lookup based on the drop-down values</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532467#M36225</link>
      <description>&lt;P&gt;Try this in your dropdown&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;choice value=""&amp;gt;All&amp;lt;/choice&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;and&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;prefix&amp;gt;(&amp;lt;/prefix&amp;gt;
&amp;lt;valuePrefix&amp;gt;like(parent_chain, "%&amp;lt;/valuePrefix&amp;gt;
&amp;lt;valueSuffix&amp;gt;%")&amp;lt;/valueSuffix&amp;gt;
&amp;lt;delimiter&amp;gt; OR &amp;lt;/delimiter&amp;gt;
&amp;lt;suffix&amp;gt;)&amp;lt;/suffix&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;and in your query&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;where $Teams$&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 09 Dec 2020 13:45:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-filter-the-data-of-lookup-based-on-the-drop-down-values/m-p/532467#M36225</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2020-12-09T13:45:14Z</dc:date>
    </item>
  </channel>
</rss>

