Dashboards & Visualizations

Check multiple fields against multiselect value?

eroffol
Path Finder

Is it possible to check multiple fields against a multiselect value?

For example:
My multiselect input has 2 values selected, NORMAL and SEVERE

I want my search to look like:

...
| where field1 == "NORMAL" OR field2 == "NORMAL" OR field1 == "SEVERE" OR field2 == "SEVERE"

I know I can achieve this by having 2 separate multiselects (one for each field), but I was wondering if it is possible to just use 1.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

After having your multiselect returning values in format "Value1,Value2" (you would need to adjust prefix/separator and other things), you can run query like this

.... | where [|gentimes start=-1 | eval field1=split("$multiselectToken",",") | table field1 | mvexpand field1] OR [|gentimes start=-1 | eval field2=split("$multiselectToken",",") | table field2 | mvexpand field2]

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

After having your multiselect returning values in format "Value1,Value2" (you would need to adjust prefix/separator and other things), you can run query like this

.... | where [|gentimes start=-1 | eval field1=split("$multiselectToken",",") | table field1 | mvexpand field1] OR [|gentimes start=-1 | eval field2=split("$multiselectToken",",") | table field2 | mvexpand field2]
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...