Dashboard Studio Multi-value Text Filtering

[samp]

I'm trying to create SPL so I can enter multiple values on a Domain text filter. For example, I'd like to enter something like *100.15.*;*100.36* and get all IPs that start with 100.15. and 100.36. Can someone provide guidance please?

[livehybrid]

Hi @samp 

You could use something like this:

| makeresults count=6
| streamstats count as n
| eval ip=case(n=1,"100.15.1.10",
               n=2,"100.15.99.5",
               n=3,"100.36.7.8",
               n=4,"100.36.200.1",
               n=5,"100.99.1.1",
               1=1,"10.0.0.1")
| search [| makeresults 
| eval user_input="100.15.*;100.36.*" 
| eval ip=split(user_input,";") 
| fields ip 
| format]

This uses a search:

[| makeresults 
| eval user_input="100.15.*;100.36.*" 
| eval ip=split(user_input,";") 
| fields ip 
| format]

To search for the IPs that match the specific pattern/input - You can replace this with a token e.g. $my_ip_list$ etc as required, and you can move it into the initial search command rather than limit later down the search depending on your requirements.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing