How to use a wildcard with the where command for a drop-down search input?

[ruchir]

Hi Everyone,

I am running a search:

| inputlookup MyLookup
| where Foo="$FooValueFromDropdown$" 
| stats values(Price)

where, $FooValueFromDropdown$ replaces itself with a value coming from a drop-down above.

When drop-down is set to some value like Cadbury or Nestle, search works fine, but when the drop-down is set to All, search shows nothing.

I tried search command, but it's not case-sensitive, which means if I have values like Cadbury(with capital C) and cadbury(with small c) and I select Cadbury with capital C, search will show results for both of them.

How can I use case-sensitivity of where and wildcard(*) friendliness of search together?

Please help.

Thank you 🙂

[emiller42]

Here is a working example of what richgalloway is talking about:

index=_internal 
| eval search_string="splunk*" 
| eval search_string=replace(search_string, "\*", "%") 
| where like(sourcetype, search_string)

Which can be simplified to:

... | where like(sourcetype, replace("splunk*", "\*", "%"))

Just replace "splunk*", with $FooValueFromDropdown$

[ruchir]

Hi emiller42

Thanks for that example, it was useful. 🙂
Do you have any suggestions on the problem I mention as comment below richgalloway's answer?

[richgalloway]

Try like.

... | where like(Foo,$FooValueFromDropdown$) | ...

The dropdown selection for All will have to be the SQL wildcard '%'.

[ruchir]

Thanks richgalloway. 🙂

It's working but the $FooValueFromDropdown$ is a URI and contains "/" character. So when I am using double quotes around $FooValueFromDropdown$ like this

... | where like(Foo,"$FooValueFromDropdown$") | ...

it's showing no result for drop-down value - All and when I am removing them, again I am not getting any results.

Any suggestions upon that?

[emiller42]

How is 'All' defined in your search form?