I have a desired list of blades and I had filtered out only those blade id's and now while creating a multiselect list I only want those blades to be grouped without using asterisk in value. Below is my query, so for "ALL" option I want only the blades filtered out in my search query. Currently, I'm using asterisk as a value but it is giving all the blades, please help me out so I can group only the desired blades against field name "ALL".
<label>SIP Blades</label>
<choice value="*">All</choice>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>Source="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>Source</fieldForLabel>
<fieldForValue>Source</fieldForValue>
<search>
<query>index=eniq source="dbmon-tail://Eniq/DC_E_IMS_CSCF_PLTFMEAS_RAW" ( Source=* NOT (io1 OR io2 OR _SYSTEM OR Proc_m0_s1 OR Proc_m0_s3 OR Proc_m0_s5 OR Proc_m0_s7 OR Proc_m0_s13 OR Proc_m0_s15)) PlatformMeasures=DEFAULT | stats count by Source
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<default></default>
</input>