How can I apply a dashboard filter that gets its values from a lookup?

[andrewtrobec]

Hello,

I am trying to filter a set dashboard charts with a multiselect token, only that the multiselect values come from a lookup. Here is where I get the values:

index="my_index" | lookup Resources.csv Resource_Name OUTPUT Team | stats values(Team) as Team | mvexpand Team

I have two issues:

1. I cannot add the token I've created to the search since the lookup values aren't available at the beginning to add as a filter.
2. Once I have multiple values, I don't know how to set the Prefix and Suffix to allow for all values

What is the recommended command to filter all data at the end according to multiple fields and field values?

Thank you and best regards,

Andrew

[andrewtrobec]

Exactly what I was looking for! Thank you!

[gcusello · Accepted solution]

Hi andrewtrobec,

if I correctly understood: you have to create a multivalue input from a lookup and then use it to filter a search?

if this is your need you have to:

create a multivalue input (called e.g. myToken) from the lookup using something like this

|inputlookup Resources.csv | dedup Team, | sort Team | table Team

putting in:

• Prefix Team="
• Suffix "
• Delimiters " OR Team="

After you can insert in your search

 index="my_index" | lookup Resources.csv Resource_Name OUTPUT Team | search $myToken$ | ...

Bye.
Giuseppe