Splunk Search

How to group multiselect drop-down values?

nravichandran
Communicator

I have a multi-select dropdown which is dynamically populated. I want to show only one option to the user to choose for a group of options and if the user selects then I should search for all the values in that group.
Example: The following results are returned from the dynamic search to populate the multi-select dropdown.
Value_one
Value_two
xyz_Unknown
abc_Unknown
fgh_Unknown
I want to present to the user the following:
Value_one
Value_two
Unknown

But when the user selects the Unknown I want to search for xyz_unknown, abc_unknown and fgh_Unknown.

Two questions:
1. How to Add "Unknown" to the multi-select dropdown (in addition to dynamically populated values and avoid xxx_Unknwon)
2. How to map the xxx_Unknown with Unknown? When user selectes Unknwon I should dynamically add to the value.

Thank you in advance.

0 Karma
1 Solution

somesoni2
Revered Legend

Use this a your populating search for multiselect. Assuming the multi-select search returns field say host and in panel searches, it's used to match against field host only.

your base search giving result with field host | eval label=if(like(host ,"%_Unknown"),"Unknown",host ) | eval host ="host =".host  | stats values(host) as host by label delim="#" | nomv host | eval host =replace(host ,"#"," OR ") 

Use label as 'field for label' and host as 'field for value'
You may need to adjust your prefix-suffix things in multiselect based on how you're using this token in your search.

View solution in original post

0 Karma

somesoni2
Revered Legend

Use this a your populating search for multiselect. Assuming the multi-select search returns field say host and in panel searches, it's used to match against field host only.

your base search giving result with field host | eval label=if(like(host ,"%_Unknown"),"Unknown",host ) | eval host ="host =".host  | stats values(host) as host by label delim="#" | nomv host | eval host =replace(host ,"#"," OR ") 

Use label as 'field for label' and host as 'field for value'
You may need to adjust your prefix-suffix things in multiselect based on how you're using this token in your search.

0 Karma

nravichandran
Communicator

Thank you!. You saved me lot of time.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...