Splunk Search
Highlighted

How to group multiselect drop-down values?

Communicator

I have a multi-select dropdown which is dynamically populated. I want to show only one option to the user to choose for a group of options and if the user selects then I should search for all the values in that group.
Example: The following results are returned from the dynamic search to populate the multi-select dropdown.
Valueone
Value
two
xyzUnknown
abc
Unknown
fghUnknown
I want to present to the user the following:
Value
one
Value_two
Unknown

But when the user selects the Unknown I want to search for xyzunknown, abcunknown and fgh_Unknown.

Two questions:
1. How to Add "Unknown" to the multi-select dropdown (in addition to dynamically populated values and avoid xxxUnknwon)
2. How to map the xxx
Unknown with Unknown? When user selectes Unknwon I should dynamically add to the value.

Thank you in advance.

0 Karma
Highlighted

Re: How to group multiselect drop-down values?

SplunkTrust
SplunkTrust

Use this a your populating search for multiselect. Assuming the multi-select search returns field say host and in panel searches, it's used to match against field host only.

your base search giving result with field host | eval label=if(like(host ,"%_Unknown"),"Unknown",host ) | eval host ="host =".host  | stats values(host) as host by label delim="#" | nomv host | eval host =replace(host ,"#"," OR ") 

Use label as 'field for label' and host as 'field for value'
You may need to adjust your prefix-suffix things in multiselect based on how you're using this token in your search.

View solution in original post

0 Karma
Highlighted

Re: How to group multiselect drop-down values?

Communicator

Thank you!. You saved me lot of time.

0 Karma