Dashboards & Visualizations

Using a field value twice while building a multi-select input token

shikhanshua
Explorer

I have a multi-select like this:

 

 

    <input token="name" type="multiselect">
      <label>Name</label>
      <choice value="*">ALL</choice>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>name="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>name</fieldForLabel>
      <fieldForValue>name</fieldForValue>
      <search>
        <query>index=my_index | dedup name | sort name</query>
      </search>
    </input>

 

 

It correctly produces a token $name$ with value:

 

 

(name="VALUE1" OR name="VALUE2" ... )

 

 

 

But I have a need to make the token look like:

 

 

(name="VALUE1" OR name="VALUE1.*" OR name="VALUE2" OR name="VALUE2.*" ... )

 

 

because if "VALUE1" is selected in the multi-select, I want events that match both "VALUE1" and "VALUE1.*" (note the dot star, not just star).

 

But I cannot just match "VALUE1*" as that will bring in events that have a different value which BEGINS with "VALUE1" which I don't want.

 

So the question is - how can I utilize the values TWICE in the token generation? I can't wrap my head around how I might be able to achieve this.

Labels (2)
0 Karma
1 Solution

marnall
Motivator

This should produce an equivalent token value:

 

 

<input token="name" type="multiselect">
<label>Name</label>
<choice value="*">ALL</choice>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>name IN ("</valuePrefix>
<valueSuffix>")</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>name</fieldForLabel>
<fieldForValue>val</fieldForValue>
<search>
<query>index=my_index | dedup name | sort name
| eval val = name+"\",\""+name+".*"</query>
</search>
</input>

 

 


This will produce token values like:

 

 

(name IN ("VALUE1","VALUE1.*") OR name IN ("VALUE2","VALUE2.*") ...)

 

 


Which are equivalent to

 

 

(name="VALUE1" OR name="VALUE1.*" OR name="VALUE2" OR name="VALUE2.*" ... )

 

 

 

EDIT: 

Now that I think about it, you can make exactly that token value by doing this:

 

<input token="name" type="multiselect">
      <label>Name</label>
      <choice value="*">ALL</choice>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix></valuePrefix>
      <valueSuffix></valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>name</fieldForLabel>
      <fieldForValue>val</fieldForValue>
      <search>
        <query>index=my_index | dedup name | sort name
| eval val = "name=\""+name+"\" OR name=\""+name+".*\""</query>
      </search>
    </input>

 

View solution in original post

shikhanshua
Explorer

Genius! Works perfectly!

0 Karma

marnall
Motivator

This should produce an equivalent token value:

 

 

<input token="name" type="multiselect">
<label>Name</label>
<choice value="*">ALL</choice>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>name IN ("</valuePrefix>
<valueSuffix>")</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>name</fieldForLabel>
<fieldForValue>val</fieldForValue>
<search>
<query>index=my_index | dedup name | sort name
| eval val = name+"\",\""+name+".*"</query>
</search>
</input>

 

 


This will produce token values like:

 

 

(name IN ("VALUE1","VALUE1.*") OR name IN ("VALUE2","VALUE2.*") ...)

 

 


Which are equivalent to

 

 

(name="VALUE1" OR name="VALUE1.*" OR name="VALUE2" OR name="VALUE2.*" ... )

 

 

 

EDIT: 

Now that I think about it, you can make exactly that token value by doing this:

 

<input token="name" type="multiselect">
      <label>Name</label>
      <choice value="*">ALL</choice>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix></valuePrefix>
      <valueSuffix></valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>name</fieldForLabel>
      <fieldForValue>val</fieldForValue>
      <search>
        <query>index=my_index | dedup name | sort name
| eval val = "name=\""+name+"\" OR name=\""+name+".*\""</query>
      </search>
    </input>

 

Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...