Search after Lookup

[akira2211]

How can I search only match field after Lookup.

For example,

index="idx_mem_mng" sourcetype="type:mem_mng:apptc_detect_error" 
| where error_count > 2 and error_type != ""
| lookup MEMORY_MANAGEMENT_APPTC_TEST_CASE.csv id as id_test_case output testcase, process
| lookup MEMORY_MANAGEMENT_APPTC_DAILY_INFO.csv id as id_daily_info output version
| search version=20201211 OR version=20201207 OR version=20201204 OR version=20201203
| mvcombine delim="," version
| sort -version
| stats list(version) as COLUMN delim="," by testcase, process 
| nomv COLUMN
| table testcase, process, COLUMN

I want to replace 

| search version=20201211 OR version=20201207 OR version=20201204 OR version=20201203

by 

|search version=$vers$

where $vers$ is multiple input (ex vers = 20201211 OR 20201207 OR 20201204 OR 20201203)

When I replace, it doesn't work. Any help plz? Thank you for your time!

[renjith_nair · Accepted solution]

You may either set the token with delimiters and include "version" string in the token itself

e.g.

<form>
  <label>Version</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="version">
      <label>Version</label>
      <choice value="20201211">20201211</choice>
      <choice value="20201207">20201207</choice>
      <choice value="20201204">20201204</choice>
      <choice value="20201203">20201203</choice>
      <valuePrefix>version="</valuePrefix>
      <delimiter> OR </delimiter>
      <valueSuffix>"</valueSuffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <h1>$version$</h1>
      </html>
    </panel>
  </row>
</form>

OR

Add an IN clause

<form>
  <label>Version</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="version">
      <label>Version</label>
      <choice value="20201211">20201211</choice>
      <choice value="20201207">20201207</choice>
      <choice value="20201204">20201204</choice>
      <choice value="20201203">20201203</choice>
      <delimiter>,</delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <h1>where version in ($version$)</h1>
      </html>
    </panel>
  </row>
</form>

[akira2211]

Thank you renjith_nair 🙂

You are right,

I found solution when add Prefix as bellow.

<valuePrefix>version=</valuePrefix>

[renjith_nair]

@akira2211, glad it worked. Appreciate a 👍  on the post 🙂