Can I edit my search or a filter field to search for multiple UserIDs as an input on my dashboard?

[hypePG]

Hello,

In one of my dashboards, I am using a filter field to search for one UserID. Can I edit my search or my filterfield, so it is possible to search for more than one userid as an input? e.g. like "userid1|userid2|userid3" as an input would resolve in something like "userid=userid1 OR userid=userid2 OR ..."

thanks in advance.

hype

[somesoni2 · Accepted solution]

You can use subsearches for the same. See the example below

index=_internal  [| gentimes start=-1 | eval sourcetype="Your|Sourcetype|List|Goes|Here" | table sourcetype | makemv sourcetype delim="|" | mvexpand sourcetype ] | stats count by sourcetype