@karthi2809 I tend to use a text box where I can insert a where clause, like this
<row id="button_row">
<panel>
<input id="events_where" type="text" token="where_clause" searchWhenChanged="true">
<label>Event filter where clause</label>
<default></default>
</input>
<event>
<search>
<query>
index=_internal host=bla
| where $where_clause$
</query>
<earliest>$selection.earliest$</earliest>
<latest>$selection.latest$</latest>
</search>
</event>
</panel>
</row>it gives you flexibility to construct whatever you want, so as long as you know how to write valid SPL queries, you can use whatever eval statements you like, e.g.
You can do it with a search clause, but I find more flexibility to use eval based filters.
You can also make your text box nice and wide using the id="xxx" in the <input> and then add this css
<row depends="$CSS$">
<panel>
<html>
<style>
#events_where .splunk-textinput { width: 400px !important; }
</style>
</html>
</panel>
</row>
I am using multiple filter in that Error search is one of the filter in which i need to type the values or multiple values with comma and i need to filter the result
