Hello,
My objective is to exclude anything the user input from an input text in a dashboard.
Search string:
index = index_string sourcetype = stype_string |eval host = mvindex(fields ,10) | where NOT host in ("$host_token$")
Input xml like this:
<input type="text" token="host_token">
<label>Host</label>
<default></default>
</input>
The above works only for a single input in the textbox.
ex. host1
But if multiple host it doesn't work. Nothing is filtered and all below host shows
ex. host1,host2,host3
