topic Using a field value twice while building a multi-select input token in Dashboards & Visualizations

Using a field value twice while building a multi-select input token

shikhanshua — Wed, 01 May 2024 14:53:44 GMT

I have a multi-select like this:

<input token="name" type="multiselect"> <label>Name</label> <choice value="*">ALL</choice> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>name="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <fieldForLabel>name</fieldForLabel> <fieldForValue>name</fieldForValue> <search> <query>index=my_index | dedup name | sort name</query> </search> </input>

It correctly produces a token $name$ with value:

(name="VALUE1" OR name="VALUE2" ... )

But I have a need to make the token look like:

(name="VALUE1" OR name="VALUE1.*" OR name="VALUE2" OR name="VALUE2.*" ... )

because if "VALUE1" is selected in the multi-select, I want events that match both "VALUE1" and "VALUE1.*" (note the dot star, not just star).

But I cannot just match "VALUE1*" as that will bring in events that have a different value which BEGINS with "VALUE1" which I don't want.

So the question is - how can I utilize the values TWICE in the token generation? I can't wrap my head around how I might be able to achieve this.

Re: Using a field value twice while building a multi-select input token

marnall — Wed, 01 May 2024 17:56:16 GMT

This should produce an equivalent token value:

<input token="name" type="multiselect"> <label>Name</label> <choice value="*">ALL</choice> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>name IN ("</valuePrefix> <valueSuffix>")</valueSuffix> <delimiter> OR </delimiter> <fieldForLabel>name</fieldForLabel> <fieldForValue>val</fieldForValue> <search> <query>index=my_index | dedup name | sort name | eval val = name+"\",\""+name+".*"</query> </search> </input>

This will produce token values like:

(name IN ("VALUE1","VALUE1.*") OR name IN ("VALUE2","VALUE2.*") ...)

Which are equivalent to

(name="VALUE1" OR name="VALUE1.*" OR name="VALUE2" OR name="VALUE2.*" ... )

EDIT:

Now that I think about it, you can make exactly that token value by doing this:

<input token="name" type="multiselect"> <label>Name</label> <choice value="*">ALL</choice> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix></valuePrefix> <valueSuffix></valueSuffix> <delimiter> OR </delimiter> <fieldForLabel>name</fieldForLabel> <fieldForValue>val</fieldForValue> <search> <query>index=my_index | dedup name | sort name | eval val = "name=\""+name+"\" OR name=\""+name+".*\""</query> </search> </input>

Re: Using a field value twice while building a multi-select input token

shikhanshua — Wed, 01 May 2024 17:29:34 GMT

Genius! Works perfectly!