How can I use a dashboard form to search an index for multiple single field values space delimited simultaneously, such as usernames and then in my output match them against another field such as phonenumber, address etc?

[cdurk]

Basically looking to create a table with matching items ie if I search for the following field username in active directory:
bob.smith tom.smith etc.

I want to match the results corresponding phone number, email etc. via a table

[cdurk]

@maciep thank you so much, this was exactly what I needed. Your a legend!

[adonio]

@cdurk,
how your data looks like? is it Active Directory data?
if so, here is a link that explains how to create an identities list using AD
http://docs.splunk.com/Documentation/ES/4.7.2/Admin/Examplemethodsofaddingassetandidentitydata
hope it helps

[maciep · Accepted solution]

so you want a text input on your dashboard where someone could just type in a list of usernames separated by spaces? And then you want to table the results of each including some info about them?

Not sure what your data looks like, but assuming you have fields called user, phone and email in your events and your input token is called t_users, then something like this might work.

index=some_index sourcetype=some:user:info
[
  | stats count 
  | eval user = split("$t_users$"," ") 
  | fields - count
  | mvexpand user
]
| table user, phone, email

The subsearch will just create a set of events for each user in the text box. Each of those events will just have one field called user. So once Splunk resolves the subsearch, the main search will look more like this (which you can see in the search log):

index=some_index sourcetype=some:user:info (user="bob.smith" OR user=" tom.smith")
| table user, phone, email

Hopefully that's sort of what you're after or helps a bit at least.

[woodcock]

You need a |noop at the beginning of your subsearch and you shouldn't need the mvexpand part.

[maciep]

why do I need a noop? It seems to work as is for me (6.6.x on laptop)...haven't used noop for a bit, but maybe I should start again? Does the subsearch resolve multi value fields like separate events ?

[woodcock]

Interesting; when did stats become a generating command? You are correct; though; |noop is no longer necessary. Yes, the subsearch automatically resolves multi-valued fields in the way that you would expect.