I have a field that I need to search on that is a long string of comma-separated values. It comes from our vulnerability scanner tool, Qualys, and looks something like this: "OS: Windows 10 22H2, P...
See more...
I have a field that I need to search on that is a long string of comma-separated values. It comes from our vulnerability scanner tool, Qualys, and looks something like this: "OS: Windows 10 22H2, Port: 53, AV: Installed, SW: Maya, SVC: SiegeTower" I have a multiselect dropdown on the dashboard with each unique tag that I want my users to be able to select any/all tags that matter to them. Application owners may only be concerned about viewing data related to their particular service on a particular operating system (user selects "OS: Windows 10 22H2" and "SVC: SiegeTower" for example). The problem I'm running into is when users select multiple tags, the search looks like this: <base search> | search TAGS IN ("OS: Windows 10 22H2","SVC: SiegeTower") | ... which returns zero results. What I really need is: <base search> | search TAGS IN ("*OS: Windows 10 22H2*","*SVC: SiegeTower*") | ... Which has wildcard characters on each search selection and does return the correct results. Is there any way to add wildcards to the multiselect dropdown selections to get the right results? The only other option I tried a combination of split and mvexpand on the TAGS field to perform the search but between thousands of endpoints and dozens of tags, I ran into memory issues that I won't be able to overcome any time soon. Any help here is appreciated!