This appears to be the cleanest way, thanks. ... View more

You can accomplish that by using cascading dropdown boxes. There are examples on how to accomplish this available in the Splunk dashboard examples app available in splunkbase here: https://splunkbase.splunk.com/app/1603/ Also there are multiple answered questions regarding this topic you can have a look: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-multiple-dependent-dropdowns-on-a-dashboard/td-p/391089 ... View more

Hi Try this | makeresults | eval test="\"POST /operation/requiredword\",\"POST /operation/requiredword | error\"" | makemv delim="," test | mvexpand test | regex test!="(\| error)" ... View more