Why is the text input not filtering results correctly in the dashboard?

[gbwilson]

So I have a dashboard with 3 different inputs. I noticed something really weird with my text input. If I enter the number 22 into my text input search, results on my dashboard stats table include 21, 22, 24, 25, 27, 28, 29, 33, etc.

Why is my text input showing me results that don't match the text input exactly?

Below is my query for the stats table:

(index=cms_vm) $arrayfield$ $lun$ $datacenter$
| dedup VM
| eval DatastoreName=replace(DatastoreName,".+_(\d+)$","\1") 
| eval StorageArray=replace(StorageArray,"^[^_]*_[^_]*\K.*$","")
| eval VM=upper(VM)
| eval StorageArray=upper(StorageArray)
| join type=outer VM [search index="cms_app_server" | fields VM Application]
| table VM OperatingSystem_Code Datacenter StorageArray DatastoreName Application
| rename OperatingSystem_Code AS "Operating System", StorageArray AS "Storage Array", DatastoreName AS "LUN"

Any help would be appreciated as I can't seem to pinpoint why this is occurring.

[Flex223]

I have been having the same problem when building one of my projects, but then I was fixed, the more problems I got with the design, but I found a good option for me, just bought several mockups from https://webdesignblog.info/html-css-templates/bootstrap-4-admin-dashboards/ it was very nice at the result.

[FrankVl · Accepted solution]

It will match any event with the string 22 in the raw event. I'm guessing it matches a 22 somewhere else then where you want to match it (the lun number), like in a timestamp or so? So you may need to create a more advanced filtering rather than just plain text search strings.
Isn't that 'lun' info available in a specific field?

Otherwise post some sample data so we can help improve your query.

[gbwilson]

@FrankVI how would you recommend doing more advanced filtering? I also tried creating a multiselect the dynamically updates based on the first two inputs. It still will display results that should not be appearing.

[FrankVl]

It would help if you could share some info on what the data looks like. But from what the rest of your search looks like, I'm guessing the DatastoreName field actually contains the LUN number that you want to filter for?

So you could try something as simple as putting the following into the token prefix field:
DatastoreName = *_

Such that the search will be:

 (index=cms_vm) $arrayfield$ DatastoreName = *_$lun$ $datacenter$ | ...

PS: you might want to do similar things for the other tokens as well, since it looks like also datacenter and array are actually related to fields?

[gbwilson]

Adding the token prefix DatastoreName=*_ fixed the issue. Thank you for your help. I will definitely do the same for my other tokens since they are related to fields.