Dashboards & Visualizations

How to consider multiple status value as one under status filter by applying multiselect filter?

Shrav
Engager

How to specify two similar value with slight differences in their spelling(i.e; "In Progress" and "In progress") as a single option in Multiselect option for particular field i.e;Status - as show in below figure:

Shrav_0-1683522852743.png

 

Labels (1)
Tags (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Shrav,

For this particular sample you can convert all status values to lowercase. Since search works case-insensitive your further searches will run without problem. Please be careful that where command works case-sensitive. 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

Shrav
Engager

@scelikok Thanks for the reply,will try by doing these changes.

 

0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...