<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Multiselect with free form in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Multiselect-with-free-form/m-p/691401#M56651</link>
    <description>&lt;P&gt;Please clarify what you mean by "except any field" - do you want to filter to search all your fields for any of them having the value defined in the text field? If so, you need to identify all the field names. Or do you simply want to search for the string value defined in the text field anywhere in the event?&lt;/P&gt;</description>
    <pubDate>Mon, 24 Jun 2024 07:45:21 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2024-06-24T07:45:21Z</dc:date>
    <item>
      <title>Multiselect with free form</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Multiselect-with-free-form/m-p/691400#M56650</link>
      <description>&lt;P&gt;Hello,&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I have a dashboard with multiselection + text input field.&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;form version="1.1" theme="light"&amp;gt;
  &amp;lt;label&amp;gt;Multiselect Text&amp;lt;/label&amp;gt;
  &amp;lt;init&amp;gt;
    &amp;lt;set token="toktext"&amp;gt;*&amp;lt;/set&amp;gt;
  &amp;lt;/init&amp;gt;
  &amp;lt;fieldset submitButton="false"&amp;gt;
    &amp;lt;input type="multiselect" token="tokselect"&amp;gt;
      &amp;lt;label&amp;gt;Field&amp;lt;/label&amp;gt;
      &amp;lt;choice value="category"&amp;gt;Group&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="severity"&amp;gt;Severity&amp;lt;/choice&amp;gt;
      &amp;lt;default&amp;gt;category&amp;lt;/default&amp;gt;
      &amp;lt;valueSuffix&amp;gt;=REPLACE&amp;lt;/valueSuffix&amp;gt;
      &amp;lt;delimiter&amp;gt; OR &amp;lt;/delimiter&amp;gt;
      &amp;lt;prefix&amp;gt;(&amp;lt;/prefix&amp;gt;
      &amp;lt;suffix&amp;gt;)&amp;lt;/suffix&amp;gt;
      &amp;lt;change&amp;gt;
        &amp;lt;eval token="tokfilter"&amp;gt;replace($tokselect$,"REPLACE","\"".$toktext$."\"")&amp;lt;/eval&amp;gt;
      &amp;lt;/change&amp;gt;
    &amp;lt;/input&amp;gt;
    &amp;lt;input type="text" token="toktext"&amp;gt;
      &amp;lt;label&amp;gt;Value&amp;lt;/label&amp;gt;
      &amp;lt;default&amp;gt;*&amp;lt;/default&amp;gt;
      &amp;lt;change&amp;gt;
        &amp;lt;eval token="tokfilter"&amp;gt;replace($tokselect$,"REPLACE","\"".$toktext$."\"")&amp;lt;/eval&amp;gt;
      &amp;lt;/change&amp;gt;
    &amp;lt;/input&amp;gt;
  &amp;lt;/fieldset&amp;gt;
  &amp;lt;row&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;event&amp;gt;
        &amp;lt;title&amp;gt;$tokfilter$&amp;lt;/title&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| makeresults&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;-24h@h&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
        &amp;lt;/search&amp;gt;
      &amp;lt;/event&amp;gt;
    &amp;lt;/panel&amp;gt;
  &amp;lt;/row&amp;gt;
&amp;lt;/form&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Now it works like that if I choose something from 'Field' and add an optional text to 'Value' start searching like this category="*" OR severity="*".&lt;/P&gt;&lt;P&gt;I'd like to build a free form where option where if the user choose that option from the 'Field' and add something in the 'Value', the search is only looking for the 'Value', like this "*" - except any field.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Could you please help me?&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thanks in advance!&lt;/P&gt;</description>
      <pubDate>Mon, 24 Jun 2024 07:30:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Multiselect-with-free-form/m-p/691400#M56650</guid>
      <dc:creator>Stopplis</dc:creator>
      <dc:date>2024-06-24T07:30:49Z</dc:date>
    </item>
    <item>
      <title>Re: Multiselect with free form</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Multiselect-with-free-form/m-p/691401#M56651</link>
      <description>&lt;P&gt;Please clarify what you mean by "except any field" - do you want to filter to search all your fields for any of them having the value defined in the text field? If so, you need to identify all the field names. Or do you simply want to search for the string value defined in the text field anywhere in the event?&lt;/P&gt;</description>
      <pubDate>Mon, 24 Jun 2024 07:45:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Multiselect-with-free-form/m-p/691401#M56651</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2024-06-24T07:45:21Z</dc:date>
    </item>
    <item>
      <title>Re: Multiselect with free form</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Multiselect-with-free-form/m-p/691402#M56652</link>
      <description>&lt;P&gt;&lt;SPAN&gt;I want to search for the string value defined in the text field anywhere in the event.&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 24 Jun 2024 08:11:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Multiselect-with-free-form/m-p/691402#M56652</guid>
      <dc:creator>Stopplis</dc:creator>
      <dc:date>2024-06-24T08:11:53Z</dc:date>
    </item>
  </channel>
</rss>

