How to group multiselect drop-down values?

[nravichandran]

I have a multi-select dropdown which is dynamically populated. I want to show only one option to the user to choose for a group of options and if the user selects then I should search for all the values in that group.
Example: The following results are returned from the dynamic search to populate the multi-select dropdown.
Value_one
Value_two
xyz_Unknown
abc_Unknown
fgh_Unknown
I want to present to the user the following:
Value_one
Value_two
Unknown

But when the user selects the Unknown I want to search for xyz_unknown, abc_unknown and fgh_Unknown.

Two questions:
1. How to Add "Unknown" to the multi-select dropdown (in addition to dynamically populated values and avoid xxx_Unknwon)
2. How to map the xxx_Unknown with Unknown? When user selectes Unknwon I should dynamically add to the value.

Thank you in advance.

[somesoni2 · Accepted solution]

Use this a your populating search for multiselect. Assuming the multi-select search returns field say host and in panel searches, it's used to match against field host only.

your base search giving result with field host | eval label=if(like(host ,"%_Unknown"),"Unknown",host ) | eval host ="host =".host  | stats values(host) as host by label delim="#" | nomv host | eval host =replace(host ,"#"," OR ") 

Use label as 'field for label' and host as 'field for value'
You may need to adjust your prefix-suffix things in multiselect based on how you're using this token in your search.

[nravichandran]

Thank you!. You saved me lot of time.