Form with a multi-value text box that will OR every input values

[harish_ka]

How to search multiple values in a text box, that should return results for all the input values.
For Ex, i have a textbox named Num in dashboard, now i can search only 1 input value,
How can i search multiple values, so that i can enter like 10,12,33 , which returns all 3 input results.
The textbox should accept the values like (Num=10 OR Num=12 OR Num=33)

[gjones_splunk]

Hi there,

Bit late in answering (but in case anyone has the same question) I had a bit of help from a colleague on this and it works a treat. Use this xml in a dashboard (against index=_internal) to get an idea of how it works.

Text Input Multi-value Filter

<input type="time" token="TimePicker">
  <label>Time Picker</label>
  <default>
    <earliest>-60m@m</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="text" token="Text_Input">
  <label>Sourcetype text filter with "," separator. It also uses the rex command in the search so you don't have to worry about spaces.</label>
  <prefix>"</prefix>
  <suffix>"</suffix>
</input>


<panel>
  <title>Example of events dedup'd by sourcetype</title>
  <table>
    <search>
      <query>index=_internal  

[ makeresults
| eval sourcetype=$Text_Input$
| makemv tokenizer="([^,]+),?" sourcetype
| mvexpand sourcetype
|rex field=sourcetype mode=sed "s/\s+//g" ]
| dedup sourcetype
| table _time host source sourcetype
$TimePicker.earliest$
$TimePicker.latest$

10
none
progressbar

index=_internal
| stats values(sourcetype)
$TimePicker.earliest$
$TimePicker.latest$

none

[sundareshr]

https://answers.splunk.com/answers/127021/manipulate-a-token-string-in-a-form.html