Filter based on token from macro

[smanojkumar]

Hi Splunkers!

    I would like to filter in a field when I received a specific value from multiselect input dropdown, 

I'm having a field "Type" where I will get multiselect values, that will be passed to a search by macro, in that search, i would like to filter "Assetname" with field of having Z in 3rd letter, only when I'm getting ADZ value from the field "Type"

When I'm not getting the value ADZ, i need to get all values in the field Assetname

Type - Indus, ADZ, Stan
Assetname - abZahd-2839

so, the Assetname with 3rd letter Z needs to be filtered.

Thanks in Advance!

Manoj Kumar S

[dtburrows3]

I think you could put in a change tag in the multiselect to evaluate a new token to use as a conditional filter based on the selection of the multiselect.

<input type="multiselect" token="Type" searchWhenChanged="true">
  <choice value="ADZ">ADZ</choice>
  ...
  <change>
    <eval token="assetname_filter">if(match('Type', "ADZ"), "match(Assetname, \"^\\S{2}Z\")", "isnotnull(Assetname)")</eval>
  </change>
  ...
</input>

And then in the search you are wanting to filter you can use the $assetname_filter$ token after a where command  like this

<base_search>
    | where $assetname_filter$

Examples of functionality:
    No ADZ selected (All assets showing)

    ADZ one of the values selected in the multiselect (Only **Z* Assetname are in final output)

[smanojkumar]

Hi @dtburrows3 ,

   Thanks for your response!

   If we need to add those two lined in a single search of macro, where we are receiving Type as a token from Search/dashboard, How to do that? 

   I tried this  way, It dosen't work

| where if(macth('Type', "ADZ"), "match(Assetname, \"^\\S{2}Z\")", "isnotnull(Assetname)")


Thanks in Advance!

[dtburrows3 · Accepted solution]

the where command is expecting some sort of boolean result after the logic statement is evaluated. The if() function you shared is passing just another logic statement. I think to do it in a where command would look something like this.

| where if(((match('Type', "ADZ") AND match('Assetname', "^\S{2}Z")) OR NOT match('Type', "ADZ")), True(), False())

Note: This method is expecting the field Type and Assetname to both be available fields in the dataset up to the point of it's execution. So a simple example of making the "Type" field available from the multiselect would be

<base_search>
    ``` make the multiselect token value an available field in the dataset ```
    ``` Since it is common for multiselect token values to be formatted with double-quotes, doing a $<token_name>|s$ here should account for that ```
    ``` It is assumed that the field "Assetname" is available and derived from <base_search> above. ```
    | eval
        Type=$Type|s$
    | where if(((match('Type', "ADZ") AND match('Assetname', "^\S{2}Z")) OR NOT match('Type', "ADZ")), True(), False())

Examples: (with ADZ in Type token)

(without ADZ in Type token)