Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Dashboards & Visualizations
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Search after Lookup
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
akira2211
Explorer
12-28-2020
07:33 PM
How can I search only match field after Lookup.
For example,
index="idx_mem_mng" sourcetype="type:mem_mng:apptc_detect_error"
| where error_count > 2 and error_type != ""
| lookup MEMORY_MANAGEMENT_APPTC_TEST_CASE.csv id as id_test_case output testcase, process
| lookup MEMORY_MANAGEMENT_APPTC_DAILY_INFO.csv id as id_daily_info output version
| search version=20201211 OR version=20201207 OR version=20201204 OR version=20201203
| mvcombine delim="," version
| sort -version
| stats list(version) as COLUMN delim="," by testcase, process
| nomv COLUMN
| table testcase, process, COLUMN
I want to replace
| search version=20201211 OR version=20201207 OR version=20201204 OR version=20201203
by
|search version=$vers$
where $vers$ is multiple input (ex vers = 20201211 OR 20201207 OR 20201204 OR 20201203)
When I replace, it doesn't work. Any help plz? Thank you for your time!
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
renjith_nair
Legend
12-28-2020
08:16 PM
You may either set the token with delimiters and include "version" string in the token itself
e.g.
<form>
<label>Version</label>
<fieldset submitButton="false">
<input type="multiselect" token="version">
<label>Version</label>
<choice value="20201211">20201211</choice>
<choice value="20201207">20201207</choice>
<choice value="20201204">20201204</choice>
<choice value="20201203">20201203</choice>
<valuePrefix>version="</valuePrefix>
<delimiter> OR </delimiter>
<valueSuffix>"</valueSuffix>
</input>
</fieldset>
<row>
<panel>
<html>
<h1>$version$</h1>
</html>
</panel>
</row>
</form>OR
Add an IN clause
<form>
<label>Version</label>
<fieldset submitButton="false">
<input type="multiselect" token="version">
<label>Version</label>
<choice value="20201211">20201211</choice>
<choice value="20201207">20201207</choice>
<choice value="20201204">20201204</choice>
<choice value="20201203">20201203</choice>
<delimiter>,</delimiter>
</input>
</fieldset>
<row>
<panel>
<html>
<h1>where version in ($version$)</h1>
</html>
</panel>
</row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
renjith_nair
Legend
12-28-2020
08:16 PM
You may either set the token with delimiters and include "version" string in the token itself
e.g.
<form>
<label>Version</label>
<fieldset submitButton="false">
<input type="multiselect" token="version">
<label>Version</label>
<choice value="20201211">20201211</choice>
<choice value="20201207">20201207</choice>
<choice value="20201204">20201204</choice>
<choice value="20201203">20201203</choice>
<valuePrefix>version="</valuePrefix>
<delimiter> OR </delimiter>
<valueSuffix>"</valueSuffix>
</input>
</fieldset>
<row>
<panel>
<html>
<h1>$version$</h1>
</html>
</panel>
</row>
</form>OR
Add an IN clause
<form>
<label>Version</label>
<fieldset submitButton="false">
<input type="multiselect" token="version">
<label>Version</label>
<choice value="20201211">20201211</choice>
<choice value="20201207">20201207</choice>
<choice value="20201204">20201204</choice>
<choice value="20201203">20201203</choice>
<delimiter>,</delimiter>
</input>
</fieldset>
<row>
<panel>
<html>
<h1>where version in ($version$)</h1>
</html>
</panel>
</row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
akira2211
Explorer
12-28-2020
08:33 PM
Thank you renjith_nair 🙂
You are right,
I found solution when add Prefix as bellow.
<valuePrefix>version=</valuePrefix>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
renjith_nair
Legend
12-28-2020
08:50 PM
@akira2211, glad it worked. Appreciate a 👍 on the post 🙂
---
What goes around comes around. If it helps, hit it with Karma 🙂
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!
Data Management Digest – December 2025
Welcome to the December edition of Data Management Digest!
As we continue our journey of data innovation, the ...
Index This | What is broken 80% of the time by February?
December 2025 Edition
Hayyy Splunk Education Enthusiasts and the Eternally Curious!
We’re back with this ...
Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...
Hello Splunk Community,
We're thrilled to share an exciting update that will help you manage your data more ...
