Splunk dashboard filter by user input with multiple value from user command field

[elend]

Hello there, im creating a #Splunk Dashboards table that utilized to monitor user command. And i want to make it flexible and dynamic to view the table by user inpu
For now i already create this search string as table that can apply filter by Find Command and Exclude Command, but it only accept single string as filter.

index=os_linux sourcetype="bash_history"
| dedup timestamp
| fields _time process, dest, user_name
| search user_name=$user_name$ dest=$host_name$ process="$user_command$" NOT process="$exclude_command$"
| table _time user_name process dest
| rename dest as hostname, process as user_command
| sort -_time

It is possible to make the exclude_command accept multiple values with some separator? or another option recomended.

[ITWhisperer]

Depending on how you have set up your exclude_command token (which you haven't shared with us yet), you could try something like this

| search user_name=$user_name$ dest=$host_name$ process="$user_command$" NOT process IN $exclude_command$

[elend]

sorry for lack of information @ITWhisperer . Here's the full information for the dashboard:

<panel>
      <title>Logging Command History by User</title>
      <input type="text" token="drilldown_command" searchWhenChanged="true">
        <label>Find Command</label>
        <default>*</default>
      </input>
      <input type="text" token="exclude_command" searchWhenChanged="true">
        <label>Exclude Command</label>
        <default>NULL</default>
      </input>
      <table>
        <search>
          <query>index=unix_os sourcetype="bash_history"
| dedup timestamp 
| fields _time process, dest, user_name
| search user_name=$user_name$ dest=$host_name$ process="$user_command$" NOT process="$exclude_command$"
| table _time user_name process dest
| rename dest as hostname, process as user_command
| sort -_time</query>
          <earliest>$time_global.earliest$</earliest>
          <latest>$time_global.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">false</option>
      </table>
    </panel>

[ITWhisperer]

| search user_name=$user_name$ dest=$host_name$ process="$user_command$" NOT process IN ($exclude_command$)

Note that your user will have to enter the terms as quoted strings delimited by commas e.g. "commandA","commandB"

[elend]

With that option, exclude input was ignored.
But if with this one changes it can apply exclude input only one value.

| search user_name=$user_name$ dest=$host_name$ process="$user_command$" NOT process IN (*$exclude_command$*)

 If search terms as quoted strings delimited by commas e.g. "commandA","commandB" it give no result:

[ITWhisperer]

What is with the asterisks? Remove them and try again

[elend]

if I remove the asterix, Exclude Command input ignore any input even single input will ignored so it only show table from find command. 

[ITWhisperer]

Can you open the search (from the dashboard table) in a separate table and share the search being used?

[elend]

Here's the output from your provided search query, it ignoring the exclude input.

[ITWhisperer · Accepted solution]

You need to split process up if you want to treat the parts of the command line up as separate things. Try this

| eval parts=split(process," ")
| search user_name=$user_name$ dest=$host_name$ process="$user_command$" NOT parts IN ($exclude_command$)

[elend]

*