Creating "Custom groups" and using them in a filter

[andreafebbo]

I would like to do on splunk something similar to what in microstrategy is colled custom groups.

I'll try to explain it as simply as I can.

I have a field i use in a multiple selection filters.

ex: colours - yellow red white black blue etc...

This list of colours is VERY long, so it's quite uncomfortable for the users select in the multiple selection filters which colours he needs.

so id like to create a group of colours called "beauty" in which I specify which colour is beautiful e which is not.

ex:
beautiful colours: red blue green
ugly colours: all others

I'd like to do this outside of the single dashboard so i can use this for filtering in many dashboards.

Before reinventing the wheel I wanted to be sure there are not known solutions.

If there are not which ones you suggest.

Thanks a lot.

[cmerriman · Accepted solution]

you can create a tag for this. then you can create a token in the dashboard for the tag

https://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Defineandusetags

but with multiple colors per tag, you might want to create an event type first and assign that event type to the tag

http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Defineeventtypes#Save_a_search_as_a_new_...

[cmerriman]

as a for instance, you could have an eventtype called beauty, the search string would just be color=Red OR color=Blue OR color=Green Tag(s) could be called beauty. save that off. then create a tag by tag name. tag name could be called beauty and field value pair would be eventtype=beauty

[andreafebbo]

I solved everything with an eventype.
Thank you!