HI, im trying to create filter for network connections. But i cannot make work few tokens in the same time. I want to create OR expression. In my head its like this: 1. search should work for if i put process_name in textfield 2. If process_name select from dropdown along with textfield  - search for both processes.  (process_name IN ("$token1$","$token2$")) 3. If First two are not chosen, but User from User dropdown selected => Filter by User. 4. If one or two process_name tokens used and User selected - filter by chosen proces_names and then by user. I have $procname2$ token for text field and $procname2$ for dropdown of processes.  Both process_name tokens work if dropdown is selected, then search will use both dropdown token and text token. User token doesn't work at all Query for search: index=sysmon_wec AND (EventCode=22 OR event_id=22) AND ((process_name IN ("$procname$", "$procname2$") OR User IN ("$user$")) )| makemv tokenizer="([^\r\n]+)(\r\n)?" User | mvexpand User |where NOT (User="SYSTEM" OR User="NT AUTHORITY\SYSTEM" OR User="NT AUTHORITY\NETWORK SERVICE" OR User="NT AUTHORITY\LOCAL SERVICE") |dedup process_name|head 100| table process_name,User,ComputerName,QueryName,QueryResults   Here is a full code of my dashboard <form version="1.1" theme="light"> <label>Find Network connections(DNS)</label> <fieldset submitButton="false"> <input type="text" token="procname2"> <label>Enter procname:eg.opera.exe</label> <default></default> </input> <input type="dropdown" token="procname" searchWhenChanged="true"> <label>Procname</label> <fieldForLabel>process_name</fieldForLabel> <fieldForValue>process_name</fieldForValue> <search> <query>index=sysmon_wec AND (EventCode=22 OR event_id=22) |dedup process_name|head 1000|table process_name</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="User" searchWhenChanged="true"> <label>User</label> <fieldForLabel>User</fieldForLabel> <fieldForValue>User</fieldForValue> <search> <query>index=sysmon_wec AND (EventCode=22 OR event_id=22) | makemv tokenizer="([^\r\n]+)(\r\n)?" User | mvexpand User |where NOT (User="SYSTEM" OR User="NT AUTHORITY\SYSTEM" OR User="NT AUTHORITY\NETWORK SERVICE" OR User="NT AUTHORITY\LOCAL SERVICE") |dedup User|head 1000|table User</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> </fieldset> <row> <panel> <table> <title>process_name</title> <search> <query>index=sysmon_wec AND (EventCode=22 OR event_id=22) AND ((process_name IN ("$procname$", "$procname2$") OR User IN ("$user$")) )| makemv tokenizer="([^\r\n]+)(\r\n)?" User | mvexpand User |where NOT (User="SYSTEM" OR User="NT AUTHORITY\SYSTEM" OR User="NT AUTHORITY\NETWORK SERVICE" OR User="NT AUTHORITY\LOCAL SERVICE") |dedup process_name|head 100| table process_name,User,ComputerName,QueryName,QueryResults</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form>   ... View more

Hi, I need to ingest some logs into splunk, so file&dirs data input its my choice. Also new index was created , _json as sourcetype. Now im trying to use spath in search to parse JSON data with multifields and no luck yet. Just checked my json file - valid json. Here we have some parsed json, but i want to get email, first_name,last_name from properties.attributes to be able parse or filter by any of this fields in future   Appreciate any help. Small source file: https://paste2.org/OsEXkgbJ   Here is what i tried : index=ep_log event=created | spath properties.attributes index=erp_log event=created | spath properties and so on ... View more