Dashboards & Visualizations

Search after Lookup

akira2211
Explorer

How can I search only match field after Lookup.

 

For example,

 

 

index="idx_mem_mng" sourcetype="type:mem_mng:apptc_detect_error" 
| where error_count > 2 and error_type != ""
| lookup MEMORY_MANAGEMENT_APPTC_TEST_CASE.csv id as id_test_case output testcase, process
| lookup MEMORY_MANAGEMENT_APPTC_DAILY_INFO.csv id as id_daily_info output version
| search version=20201211 OR version=20201207 OR version=20201204 OR version=20201203
| mvcombine delim="," version
| sort -version
| stats list(version) as COLUMN delim="," by testcase, process 
| nomv COLUMN
| table testcase, process, COLUMN

 

 

 

I want to replace 

 

 

| search version=20201211 OR version=20201207 OR version=20201204 OR version=20201203

 

 

by 

 

 

|search version=$vers$

 

 

where $vers$ is multiple input (ex vers = 20201211 OR 20201207 OR 20201204 OR 20201203)

 

When I replace, it doesn't work. Any help plz? Thank you for your time!

Labels (3)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

You may either set the token with delimiters and include "version" string in the token itself

e.g.

<form>
  <label>Version</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="version">
      <label>Version</label>
      <choice value="20201211">20201211</choice>
      <choice value="20201207">20201207</choice>
      <choice value="20201204">20201204</choice>
      <choice value="20201203">20201203</choice>
      <valuePrefix>version="</valuePrefix>
      <delimiter> OR </delimiter>
      <valueSuffix>"</valueSuffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <h1>$version$</h1>
      </html>
    </panel>
  </row>
</form>

OR

Add an IN clause

<form>
  <label>Version</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="version">
      <label>Version</label>
      <choice value="20201211">20201211</choice>
      <choice value="20201207">20201207</choice>
      <choice value="20201204">20201204</choice>
      <choice value="20201203">20201203</choice>
      <delimiter>,</delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <h1>where version in ($version$)</h1>
      </html>
    </panel>
  </row>
</form>
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

You may either set the token with delimiters and include "version" string in the token itself

e.g.

<form>
  <label>Version</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="version">
      <label>Version</label>
      <choice value="20201211">20201211</choice>
      <choice value="20201207">20201207</choice>
      <choice value="20201204">20201204</choice>
      <choice value="20201203">20201203</choice>
      <valuePrefix>version="</valuePrefix>
      <delimiter> OR </delimiter>
      <valueSuffix>"</valueSuffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <h1>$version$</h1>
      </html>
    </panel>
  </row>
</form>

OR

Add an IN clause

<form>
  <label>Version</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="version">
      <label>Version</label>
      <choice value="20201211">20201211</choice>
      <choice value="20201207">20201207</choice>
      <choice value="20201204">20201204</choice>
      <choice value="20201203">20201203</choice>
      <delimiter>,</delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <h1>where version in ($version$)</h1>
      </html>
    </panel>
  </row>
</form>
Happy Splunking!
0 Karma

akira2211
Explorer

Thank you renjith_nair 🙂

 

You are right,

I found solution when add Prefix as bellow.

<valuePrefix>version=</valuePrefix>

 

renjith_nair
SplunkTrust
SplunkTrust

@akira2211, glad it worked. Appreciate a 👍  on the post 🙂

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...