Find events matching a multi-value field

[davby]

I am defining a dashboard panel that uses a token $s_user$ that may contain a comma-separated list of values (it is set from $row.field$ for a multivalue field). I want to find events where the user field matches one of the values in $s_user$ (as well as some other criteria).

For example, if $s_user$ is "user1,user2,user3", then I want a search that does the equivalent of:

client=$client$ AND (user=user1 OR user=user2 OR user=user3)

What is the best way to accomplish this?

I have tried the following, which works but seems clumsy (particularly since I have several tokens like s_user):

client=$client$ AND [search * | head 1 | eval user=split("$s_user$", ",") | fields user | format]

I have also tried this, which sort of works:

client=$client$ | eval users=split("$s_user$", ",") | where mvfind(users, user) >= 0

But that I suspect that is far slower, is also clumsy, and won't do the right thing if the user field contains regexp metacharacters.

[somesoni2 · Accepted solution]

Give this a try (should be faster than whatever you've tried so far)

client=$client$ AND [| gentimes start=-1 | eval user="$s_user$" | makemv delim="," user | mvexpand user | table user | format]

[somesoni2]

Great.. Please accept the answer if there are no followup question around the same.

[k_harini]

@somesoni2, can you please help here.

I have exactly similar case and I tried the answer you gave, its taking only first value and not all the values.
index=xxx_index| search Project="abc Online" AND [|gentimes start=-1|eval ref_incident_u_n_1_group = "abc Online MDT Support, abc Online Support" | makemv delim="," ref_incident_u_n_1_group|mvexpand ref_incident_u_n_1_group|table ref_incident_u_n_1_group|format ] |stats count by ref_incident_u_n_1_group work_queue
I will be passing token to ref_incident_u_n_1_group with , delimiter as in the query. Here for stats I get results for "abc Online MDT Support" but not for "abc Online Support". Is it because of spaces..? what could be the reason? please suggest

[k_harini]

This is working now. Thanks much

[davby]

That seems to work, and taught me about gentimes and helped me understand more about format.