Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Dashboards & Visualizations
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Splunk Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Search after Lookup
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
akira2211
Explorer
12-28-2020
07:33 PM
How can I search only match field after Lookup.
For example,
index="idx_mem_mng" sourcetype="type:mem_mng:apptc_detect_error"
| where error_count > 2 and error_type != ""
| lookup MEMORY_MANAGEMENT_APPTC_TEST_CASE.csv id as id_test_case output testcase, process
| lookup MEMORY_MANAGEMENT_APPTC_DAILY_INFO.csv id as id_daily_info output version
| search version=20201211 OR version=20201207 OR version=20201204 OR version=20201203
| mvcombine delim="," version
| sort -version
| stats list(version) as COLUMN delim="," by testcase, process
| nomv COLUMN
| table testcase, process, COLUMN
I want to replace
| search version=20201211 OR version=20201207 OR version=20201204 OR version=20201203
by
|search version=$vers$
where $vers$ is multiple input (ex vers = 20201211 OR 20201207 OR 20201204 OR 20201203)
When I replace, it doesn't work. Any help plz? Thank you for your time!
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
renjith_nair
Legend
12-28-2020
08:16 PM
You may either set the token with delimiters and include "version" string in the token itself
e.g.
<form>
<label>Version</label>
<fieldset submitButton="false">
<input type="multiselect" token="version">
<label>Version</label>
<choice value="20201211">20201211</choice>
<choice value="20201207">20201207</choice>
<choice value="20201204">20201204</choice>
<choice value="20201203">20201203</choice>
<valuePrefix>version="</valuePrefix>
<delimiter> OR </delimiter>
<valueSuffix>"</valueSuffix>
</input>
</fieldset>
<row>
<panel>
<html>
<h1>$version$</h1>
</html>
</panel>
</row>
</form>OR
Add an IN clause
<form>
<label>Version</label>
<fieldset submitButton="false">
<input type="multiselect" token="version">
<label>Version</label>
<choice value="20201211">20201211</choice>
<choice value="20201207">20201207</choice>
<choice value="20201204">20201204</choice>
<choice value="20201203">20201203</choice>
<delimiter>,</delimiter>
</input>
</fieldset>
<row>
<panel>
<html>
<h1>where version in ($version$)</h1>
</html>
</panel>
</row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
renjith_nair
Legend
12-28-2020
08:16 PM
You may either set the token with delimiters and include "version" string in the token itself
e.g.
<form>
<label>Version</label>
<fieldset submitButton="false">
<input type="multiselect" token="version">
<label>Version</label>
<choice value="20201211">20201211</choice>
<choice value="20201207">20201207</choice>
<choice value="20201204">20201204</choice>
<choice value="20201203">20201203</choice>
<valuePrefix>version="</valuePrefix>
<delimiter> OR </delimiter>
<valueSuffix>"</valueSuffix>
</input>
</fieldset>
<row>
<panel>
<html>
<h1>$version$</h1>
</html>
</panel>
</row>
</form>OR
Add an IN clause
<form>
<label>Version</label>
<fieldset submitButton="false">
<input type="multiselect" token="version">
<label>Version</label>
<choice value="20201211">20201211</choice>
<choice value="20201207">20201207</choice>
<choice value="20201204">20201204</choice>
<choice value="20201203">20201203</choice>
<delimiter>,</delimiter>
</input>
</fieldset>
<row>
<panel>
<html>
<h1>where version in ($version$)</h1>
</html>
</panel>
</row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
akira2211
Explorer
12-28-2020
08:33 PM
Thank you renjith_nair 🙂
You are right,
I found solution when add Prefix as bellow.
<valuePrefix>version=</valuePrefix>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
renjith_nair
Legend
12-28-2020
08:50 PM
@akira2211, glad it worked. Appreciate a 👍 on the post 🙂
---
What goes around comes around. If it helps, hit it with Karma 🙂
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!
Introducing the Splunk Community Dashboard Challenge!
Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...
Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...
Wednesday, May 29, 2024 | 11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...
Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...
We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...
