Can you use a wild character in a Multiselect?

[robertlynch2020]

Hi

In a MultiSelect is there any way to us a wild character?

My Data

XYC_123
EOD_1234
EOD_23232
EOD_343434
aassss_34343

So, i would like to pick all the EOD so (Star)EOD(Star).

I can put this in manually, however, I want to do it dynamically from the search box.
I want to put in (Star)ANYTHING(Star)

[thambisetty]

@jeffland Thanks for the solution. That's exactly what I was looking for. 
https://docs.splunk.com/Documentation/Splunk/8.0.0/Viz/PanelreferenceforSimplifiedXML#input_.28form....

[493669]

try this run anywhere example:

<form>
   <label>Checkbox</label>
   <fieldset submitButton="false">
     <input type="checkbox" token="source" searchWhenChanged="true">
       <label>Source</label>
       <default></default>
       <fieldForLabel>source</fieldForLabel>
       <fieldForValue>source</fieldForValue>
       <search>
         <query>index=_* | eval source=substr('source',1,5) | stats count by source</query>
         <earliest>0</earliest>
         <latest></latest>
       </search>
       <choice value="">ALL</choice>
       <initialValue></initialValue>
       <delimiter> OR </delimiter>
       <prefix>(</prefix>
       <suffix>)</suffix>
       <valuePrefix>source like "%</valuePrefix>
       <valueSuffix>%"</valueSuffix>
     </input>
   </fieldset>
   <row>
     <panel>
       <table>
         <title>$source$</title>
         <search>
           <query>index=_* | where $source$ | stats count</query>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
           <sampleRatio>1</sampleRatio>
         </search>
         <option name="count">20</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">none</option>
         <option name="percentagesRow">false</option>
         <option name="rowNumbers">false</option>
         <option name="totalsRow">false</option>
         <option name="wrap">true</option>
       </table>
     </panel>
   </row>
 </form>

Reference: https://answers.splunk.com/answers/615201/why-is-the-checkbox-input-filter-source-in-my-dash.html

[jeffland]

The easy solution to this is the option "allowCustomValues" on a multiselect. With this, you can input custom values that can include a wildcard.

<input type="multiselect" token="multi_tok">
  <label>multi with custom values</label>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>sourcetype</fieldForValue>
  <search>
    <query>| tstats count where index=_internal by sourcetype</query>
    <earliest>-60m@m</earliest>
    <latest>now</latest>
  </search>
  <allowCustomValues>true</allowCustomValues>
</input>