so you want a text input on your dashboard where someone could just type in a list of usernames separated by spaces? And then you want to table the results of each including some info about them?
Not sure what your data looks like, but assuming you have fields called user, phone and email in your events and your input token is called t_users, then something like this might work.
index=some_index sourcetype=some:user:info [ | stats count | eval user = split("$t_users$"," ") | fields - count | mvexpand user ] | table user, phone, email
The subsearch will just create a set of events for each user in the text box. Each of those events will just have one field called user. So once Splunk resolves the subsearch, the main search will look more like this (which you can see in the search log):
index=some_index sourcetype=some:user:info (user="bob.smith" OR user=" tom.smith") | table user, phone, email
Hopefully that's sort of what you're after or helps a bit at least.
You need a
|noop at the beginning of your subsearch and you shouldn't need the
why do I need a noop? It seems to work as is for me (6.6.x on laptop)...haven't used noop for a bit, but maybe I should start again? Does the subsearch resolve multi value fields like separate events ?
Interesting; when did
stats become a generating command? You are correct; though;
|noop is no longer necessary. Yes, the subsearch automatically resolves multi-valued fields in the way that you would expect.
how your data looks like? is it Active Directory data?
if so, here is a link that explains how to create an identities list using AD
hope it helps
@maciep thank you so much, this was exactly what I needed. Your a legend!