I have a multi-select like this:     <input token="name" type="multiselect"> <label>Name</label> <choice value="*">ALL</choice> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>name="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <fieldForLabel>name</fieldForLabel> <fieldForValue>name</fieldForValue> <search> <query>index=my_index | dedup name | sort name</query> </search> </input>     It correctly produces a token $name$ with value:     (name="VALUE1" OR name="VALUE2" ... )       But I have a need to make the token look like:     (name="VALUE1" OR name="VALUE1.*" OR name="VALUE2" OR name="VALUE2.*" ... )     because if "VALUE1" is selected in the multi-select, I want events that match both "VALUE1" and "VALUE1.*" (note the dot star, not just star).   But I cannot just match "VALUE1*" as that will bring in events that have a different value which BEGINS with "VALUE1" which I don't want.   So the question is - how can I utilize the values TWICE in the token generation? I can't wrap my head around how I might be able to achieve this. ... View more

I have events like these (just some made-up data), that are pushed in JSON format to Splunk:       {"name":"abc", "grade":"third", "result": "PASS", "courses":["math","science","literature"], "interests":["this","that"]}       Events are being generated all the time, and I need to get the latest values of "result", "courses" and "interests" for a given "name" and "grade". Note that "courses" and "interests" are lists/arrays, while other fields are strings. So I am doing somethings like:       index=whatever name=abc grade=third | stats latest(courses) as courses, latest(interests) as interests, latest(result) as result index=whatever name=abc grade=third | stats latest(courses{}) as courses, latest(interests{}) as interests, latest(result) as result index=whatever name=abc grade=third | eval courses=json_array_to_mv(courses), interests=json_array_to_mv(interests) | stats latest(courses) as courses, latest(interests) as interests, latest(result) as result         Also tried with "tstats" approach.   None of those work. I get the courses and interests as empty values. result comes in fine, because its a string.   How can I get the "latest" lists of courses and interests given other values? ... View more