Multivalue Text Input Fields

[DSMcL]

I have been struggling to get a multivalue text input field to work. Originally, I had tried this approach:

index=<index> sourcetype=<sourcetype> [stats count | eval url = "$key$" | makemv url delim=" " | mvexpand url | fields url] | table url, host

I am trying to look for any values input into the text field that are separated by spaces (I've also tried commas), in the URL field of the results. This didn't work for me and did not return any results when using more than one value in the text input.

index=<index> sourcetype=<sourcetype> url IN ($key$) 

This DOES work.

My question is, can I do this with spaces instead of commas? And, also, can I automatically add wildcards (*) at the beginning and end of each individual entry in the input field?

Thank you in advance.

[marycordova]

Can you please post a sample data set?

[DSMcL]

Thank you for your reply. I can try to sanitize a data set, but they are sensitive log files so it would be rather difficult. Yes, it is a dashboard and I am passing a token (the token is called "key") from a text entry box.

I believe I now have the multivalue text input search working like this:

index=<index> sourcetype=<sourcetype> url IN ($key$)

and

index=<index> sourcetype=<sourcetype> [stats count | eval url = "$key$" | makemv url delim=" " | mvexpand url | fields url] | table url, host

I prefer the second way as I can use space as the delimiter. I believe the reason it wasn't working before was because of the formatting of the input.

I am still unable to add in *'s at the beginning and end of each entry automatically.

Ex.

textfield: google.com,msn.com,bing.com

but have the search look for *google.com*, *msn.com*, or *bing.com*.

Is there a way that add the wildcards in before searching?

I apologize for not having figured out my first issue earlier, a blatant oversight on my part.

[marycordova]

Also, is this in a Dashboard where you are passing in a token from a text entry box in the Dashboard?