Splunk Search

How to group selected blade Id's to Multiselect option?

x186855
New Member

I have a desired list of blades and I had filtered out only those blade id's and now while creating a multiselect list I only want those blades to be grouped without using asterisk in value. Below is my query, so for "ALL" option I want only the blades filtered out in my search query. Currently, I'm using asterisk as a value but it is giving all the blades, please help me out so I can group only the desired blades against field name "ALL".

    <label>SIP Blades</label>
    <choice value="*">All</choice>
    <prefix>(</prefix>
    <suffix>)</suffix>
    <valuePrefix>Source="</valuePrefix>
    <valueSuffix>"</valueSuffix>
    <delimiter> OR </delimiter>
    <fieldForLabel>Source</fieldForLabel>
    <fieldForValue>Source</fieldForValue>
    <search>
      <query>index=eniq source="dbmon-tail://Eniq/DC_E_IMS_CSCF_PLTFMEAS_RAW" ( Source=* NOT (io1 OR io2 OR _SYSTEM OR Proc_m0_s1 OR Proc_m0_s3 OR Proc_m0_s5 OR Proc_m0_s7 OR Proc_m0_s13 OR Proc_m0_s15)) PlatformMeasures=DEFAULT  | stats count by Source
      <earliest>-24h@h</earliest>
      <latest>now</latest>
    </search>
    <default></default>
  </input>
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...