how to pass filter token based on filter value in search query?

avni26 — Wed, 26 Feb 2020 18:21:32 GMT

Hi,
I have below multiselect filter , based on username="ABC" , I need to display two more filters.( ip, city)
And when those two input multiselect values should also reflect on our all panel , else it should not get search

<input id="selid"> <search >      <query>search user IN ($seluser$) |      table id | dedup id</query> </search>    <delimiter>, </delimiter>      <default>*</default> <change>      <condition value="ABC"> <set      token="set_tok"></set> <set      token="set_info">  ip IN ($selip$) city IN      ($selcity$)</set> </condition>      <condition> <unset      token="set_tok"></unset> <set      token="set_info"></set> </condition>     </change></input>

Base query:
index........ | search name IN ($selname$) user IN ($seluser$) id IN($selid$) $set_info$

Now , I want to show below as in panel
When I select user=ABC
index ... | search name IN ($selname$) user IN ($seluser$) id IN($selid$) ip IN ($selip$) city IN ($selcity$)

else for other user
index ... | search name IN ($selname$) user IN ($seluser$) id IN($selid$)

I am getting problem , when I am trying to change the value on any of those two filter (ip, city) , its only taking the initial value , when I changed to anything else no effect on panels,
Please suggest , what I am doing wrong here.

Re: how to pass filter token based on filter value in search query?

to4kawa — Wed, 26 Feb 2020 21:02:04 GMT

 <set token="set_info"> ip IN ($selip$) city IN      ($selcity$)</set>

this statement only works at first.

Re: how to pass filter token based on filter value in search query?

avni26 — Thu, 27 Feb 2020 05:33:27 GMT

@to4kawa yes, how to write and at where should this statement will go? Please suggest

Re: how to pass filter token based on filter value in search query?

to4kawa — Thu, 27 Feb 2020 08:53:45 GMT

three tokens throw main search. not to input.

topic Re: how to pass filter token based on filter value in search query? in Splunk Search

how to pass filter token based on filter value in search query?

Re: how to pass filter token based on filter value in search query?

Re: how to pass filter token based on filter value in search query?

Re: how to pass filter token based on filter value in search query?