Why am I unable to search with string tokens against two fields on an lookup?

[POR160893]

Hi,

I have a dashboard where the data is coming from a lookup called "ABC" which has 2 fields called "src_ip" and "dest_ip", respectively.

On the same dashboard, I now need to add a textbook such that a user inputs 1 or more IP addresses, searches against BOTH the "src_ip" and "dest_ip" fields on the lookup, and this filters the final results on the dashboard.

The issue I am having is all the IP address are string values and I am having trouble refining the search as this is the error I am currently getting:
 Error in 'where' command: The expression is malformed. An unexpected character is reached at '*) OR like(dest_ip,*)'.

So, a search like this works for me:
| inputlookup ABC
| where like (dest_ip,"10.175.96.146 10.175.96.147 10.175.96.148 10.175.96.149 10.175.96.150 10.175.96.183").

I am unable to search against both these "src_ip" and "dest_ip" when using a token though for an input like this:
<query>| inputlookup ABC
| where like(src_ip,$srcip_tok$) OR like(dest_ip,$srcip_tok$)
</query>

Can you please help?

Thanks as always

[ITWhisperer]

Try with token filters

| where like(src_ip,$srcip_tok|s$) OR like(dest_ip,$srcip_tok|s$)

[POR160893]

Hi,

This doesn't work.

When I input "10.105.12.19" as the input, it generates no results and the resulting search is as follows:
| inputlookup firewall_rule_owner
| where like(src_ip,"10.105.12.19") OR like(dest_ip,"10.105.12.19")

When I input multiple IP addresses as the input (comma separated) i.e. 10.105.12.19, 10.175.96.146, I also generate no results and the resulting search is:
| inputlookup firewall_rule_owner
| where like(src_ip,"10.105.12.19, 10.175.96.146") OR like(dest_ip,"10.105.12.19, 10.175.96.146")

Finally, when I input nothing and the dashboard runs on the default  text field value *, I generate no results with the search:
| inputlookup firewall_rule_owner
| where like(src_ip,"*") OR like(dest_ip,"*")


I need all 3 instances to work for the stakeholder. Can you please help?