I need help in displaying the input radio button option based on previous input radio button option selection. If i have below options created as inputs :   <input type="Radio" token="environment"> <label >ENV<label> <choice value="site1">s1</choice> <choice value="site2">s2</choice> <choice value="site3">s3</choice> </input> <input type="Radio" token="sub-environment"> <label >S-ENV<label> <choice value="site1-Area1">s1A1</choice> <choice value="site1-Area2">s1A2</choice> <choice value="site1-Area3">s1A3</choice> <choice value="site2-Area1">s2A1</choice> <choice value="site2-Area2">s2A2</choice> <choice value="site2-Area3">s2A3</choice> <choice value="site3-Area1">s3A1</choice> <choice value="site3-Area2">s3A2</choice> <choice value="site3-Area3">s3A3</choice> <choice value="*">All</choice> </input>   I wan to dynamically display the input fields based on the first radio button option selection.     if user selects site1 radio button option automatically display radio button option labels  labels s1A1,s1A2, s1A3 and All    if user selects site2 radio button option automatically display radio button option labels  labels s2A1,s2A2, s2A3 and All    if user selects site3 radio button option automatically display radio button option labels  labels s3A1,s3A2, s3A3 and *   ... View more

I am trying to identify the values that are in the logs not matching with content in the lookup file. But i am not getting the results. Here is the sample log 192.168.198.92 - - [22/Dec/2002:23:08:37 -0400] "GET / HTTP/1.1" 200 6394 www.yahoo.com  "xab|xac|za1" 192.168.198.92 - - [22/Dec/2002:23:08:38 -0400] "GET /images/logo.gif HTTP/1.1" 200 807 www.yahoo.com  "None" 192.168.198.92 - - [22/Dec/2002:23:08:37 -0400] "GET / HTTP/1.1" 200 6394 www.yahoo.com  "xab|xac|za1" 192.168.72.177 - - [22/Dec/2002:23:32:14 -0400] "GET /news/Tshirts.html HTTP/1.1" 200 3500 www.yahoo.com  "yif" 192.168.72.177 - - [22/Dec/2002:23:32:14 -0400] "GET /news/Jeans.html HTTP/1.1" 200 3500 www.yahoo.com  "zab|yif|ba1|ba1" 192.168.72.177 - - [22/Dec/2002:23:32:14 -0400] "GET /news/Polos.html HTTP/1.1" 200 3500 www.yahoo.com  "zab|yif" the last value of the log( "xab|xac|za1") is stored as signature field in splunk. which says multiple signatures matched the requests. For few requests only one signature might have triggered. I would like to compare the signatures in the logs with the list of signatures in the lookup table. example lookup: lookup table signature.csv and it contains these values: signature_lookup xab yab xac zac zal yif zab bal I have tried multiped queries for splitting and checking for those signatures in lookup file and if it not matched then only that result should display. But i am getting both matched and unmatched content as query result. Don't know where i am doing the mistake. index=* source type=* NOT(signature="None") |makemv delim = "|" signature |mvexpand signature |lookup signature.csv signature_lookup |search signature!=signature_lookup |table signature | dedup signature Also tried below query but no luck... index=* sourcetype=* NOT(signature="None") |eval sign_split=mvindex(split(signature,"|"),0) |lookup signature.csv signature_lookup as sign_split |table signature | dedup signature Can some one help me in resolving this ... View more