topic How can I apply a dashboard filter that gets its values from a lookup? in Dashboards & Visualizations

How can I apply a dashboard filter that gets its values from a lookup?

andrewtrobec — Thu, 24 Nov 2016 13:18:25 GMT

Hello,

I am trying to filter a set dashboard charts with a multiselect token, only that the multiselect values come from a lookup. Here is where I get the values:

index="my_index" | lookup Resources.csv Resource_Name OUTPUT Team | stats values(Team) as Team | mvexpand Team

I have two issues:

I cannot add the token I've created to the search since the lookup values aren't available at the beginning to add as a filter.
Once I have multiple values, I don't know how to set the Prefix and Suffix to allow for all values

What is the recommended command to filter all data at the end according to multiple fields and field values?

Thank you and best regards,

Andrew

Re: How can I apply a dashboard filter that gets its values from a lookup?

gcusello — Fri, 25 Nov 2016 08:33:06 GMT

Hi andrewtrobec,

if I correctly understood: you have to create a multivalue input from a lookup and then use it to filter a search?

if this is your need you have to:

create a multivalue input (called e.g. myToken) from the lookup using something like this

|inputlookup Resources.csv | dedup Team, | sort Team | table Team

putting in:

Prefix Team="
Suffix "
Delimiters " OR Team="

After you can insert in your search

 index="my_index" | lookup Resources.csv Resource_Name OUTPUT Team | search $myToken$ | ...

Bye.
Giuseppe

Re: How can I apply a dashboard filter that gets its values from a lookup?

andrewtrobec — Fri, 25 Nov 2016 16:58:56 GMT

Exactly what I was looking for! Thank you!