Multiselect Tstats Tokens

[robertlynch2020]

Hi

I am trying to apply a Multiselect into a token.
For example, I can change the value of MXTIMING.NPID to the PID 123 and it works - so that is one value.
What I want to do is activate a Multiselect on this token so I can select 123 and 345 and 345, etc. ...

I have tried to add in a prefix of OR but it's not working.

INITIAL - Query

    <query>| tstats summariesonly=$summariesonly_token$ avg(MXTIMING.Elapsed) AS average FROM datamodel=MXTIMING_TEST WHERE 
               host=$host_token$ 
    AND MXTIMING.source_path = *$source_path_search_token$ 
    AND MXTIMING.UserName2=$MXTIMING_UserName_token$ 
    AND MXTIMING.NPID=*$MXTIMING_NPID_token$*  
    AND MXTIMING.MXTIMING_TYPE_DM=$MXTIMING_TYPE_TOKEN$ 
    AND MXTIMING.Context+Command = *$MXTIMING_Context_token$#*
    AND MXTIMING.Context+Command = *#$MXTIMING_Command_token$*
    AND MXTIMING.Time = *
    GROUPBY MXTIMING.Context+Command MXTIMING.NPID MXTIMING.Time 

I tried to add in a way to use OR, but i cant seem to find a way - to me this would be the best way

  <query>| tstats summariesonly=$summariesonly_token$ avg(MXTIMING.Elapsed) AS average FROM datamodel=MXTIMING_TEST WHERE 
                   host=$host_token$ 
        AND MXTIMING.source_path = *$source_path_search_token$ 
        AND MXTIMING.UserName2=$MXTIMING_UserName_token$ 
        AND MXTIMING.NPID="1123" OR "11232"  
        AND MXTIMING.MXTIMING_TYPE_DM=$MXTIMING_TYPE_TOKEN$ 
        AND MXTIMING.Context+Command = *$MXTIMING_Context_token$#*
        AND MXTIMING.Context+Command = *#$MXTIMING_Command_token$*
        AND MXTIMING.Time = *
        GROUPBY MXTIMING.Context+Command MXTIMING.NPID MXTIMING.Time 

In the end i have to change the TOKEN to equal the full string repeating it self [], however this is long and if i want to use this token again i will have to strip out the token value prefix = MXTIMING.NPID

    <query>| tstats summariesonly=$summariesonly_token$ avg(MXTIMING.Elapsed) AS average FROM datamodel=MXTIMING_TEST WHERE 
               host=$host_token$ 
    AND MXTIMING.source_path = *$source_path_search_token$ 
    AND MXTIMING.UserName2=$MXTIMING_UserName_token$ 
  MXTIMING.NPID=10025 OR MXTIMING.NPID=10784 OR MXTIMING.NPID=11858 OR MXTIMING.NPID=12170  
    AND MXTIMING.MXTIMING_TYPE_DM=$MXTIMING_TYPE_TOKEN$ 
    AND MXTIMING.Context+Command = *$MXTIMING_Context_token$#*
    AND MXTIMING.Context+Command = *#$MXTIMING_Command_token$*
    AND MXTIMING.Time = *
    GROUPBY MXTIMING.Context+Command MXTIMING.NPID MXTIMING.Time 

[robertlynch2020 · Accepted solution]

Hi

I fond an answer to this

MXTIMING.NPID IN (10025 10948 11858)

boom 🙂