topic Re: Search after Lookup in Dashboards & Visualizations

Search after Lookup

akira2211 — Tue, 29 Dec 2020 03:33:16 GMT

How can I search only match field after Lookup.

For example,

index="idx_mem_mng" sourcetype="type:mem_mng:apptc_detect_error" | where error_count > 2 and error_type != "" | lookup MEMORY_MANAGEMENT_APPTC_TEST_CASE.csv id as id_test_case output testcase, process | lookup MEMORY_MANAGEMENT_APPTC_DAILY_INFO.csv id as id_daily_info output version | search version=20201211 OR version=20201207 OR version=20201204 OR version=20201203 | mvcombine delim="," version | sort -version | stats list(version) as COLUMN delim="," by testcase, process | nomv COLUMN | table testcase, process, COLUMN

I want to replace

| search version=20201211 OR version=20201207 OR version=20201204 OR version=20201203

|search version=$vers$

where $vers$ is multiple input (ex vers = 20201211 OR 20201207 OR 20201204 OR 20201203)

When I replace, it doesn't work. Any help plz? Thank you for your time!

Re: Search after Lookup

renjith_nair — Tue, 29 Dec 2020 04:16:04 GMT

You may either set the token with delimiters and include "version" string in the token itself

e.g.

<form> <label>Version</label> <fieldset submitButton="false"> <input type="multiselect" token="version"> <label>Version</label> <choice value="20201211">20201211</choice> <choice value="20201207">20201207</choice> <choice value="20201204">20201204</choice> <choice value="20201203">20201203</choice> <valuePrefix>version="</valuePrefix> <delimiter> OR </delimiter> <valueSuffix>"</valueSuffix> </input> </fieldset> <row> <panel> <html> <h1>$version$</h1> </html> </panel> </row> </form>

Add an IN clause

<form> <label>Version</label> <fieldset submitButton="false"> <input type="multiselect" token="version"> <label>Version</label> <choice value="20201211">20201211</choice> <choice value="20201207">20201207</choice> <choice value="20201204">20201204</choice> <choice value="20201203">20201203</choice> <delimiter>,</delimiter> </input> </fieldset> <row> <panel> <html> <h1>where version in ($version$)</h1> </html> </panel> </row> </form>

Re: Search after Lookup

akira2211 — Tue, 29 Dec 2020 04:33:44 GMT

Thank you renjith_nair 🙂

You are right,

I found solution when add Prefix as bellow.

<valuePrefix>version=</valuePrefix>

Re: Search after Lookup

renjith_nair — Tue, 29 Dec 2020 04:50:52 GMT

@akira2211, glad it worked. Appreciate a 👍 on the post 🙂