Is there a way to add the java script in xml inline? I am using cloud version and don't have rights to add the script in path. ... View more

Is there a way to add the java script in xml inline. I am using cloud version and don't have rights to add the script in path. ... View more

Looks like replacing makeresults with search command is working correctly. Thanks @gcusello    ... View more

That is what my initial question was. I don't want to do a search as the value i am expecting from subsearch is static. Is there any other way to get result? With full search, results is getting repeated for the given time duration. Verified the result with | makeresults. I am getting the result as (((apps="app/yellow*" OR apps="app/green*"))) ... View more

it is not working when ending up fields also. This is what i am testing: index=main servicetype="aws:accesslogs" [ search | eval prods="[{\"product\":\"101\",\"color\":[\"red\",\"green\",\"blue\"]},{\"product\":\"102\",\"color\":[\"yellow\",\"green\"]}]" | spath path={} input=prods output=prodcols| mvexpand prodcols| spath input=prodcols | rename color{} as colors | where 'product' = "102" | eval result="app/".mvjoin(colors,",app/") | rex field=result mode=sed "s/,/*,/g" | eval result=result."*" | eval apps=split(result,",") | fields apps When i replace the string coming from |format into main query, i am getting the result. Can you please check what is wrong in this? ... View more

it is not working when ending up fields also. This is what i am testing: index=main servicetype="aws:accesslogs" [ search | eval prods="[{\"product\":\"101\",\"color\":[\"red\",\"green\",\"blue\"]},{\"product\":\"102\",\"color\":[\"yellow\",\"green\"]}]" | spath path={} input=prods output=prodcols| mvexpand prodcols| spath input=prodcols | rename color{} as colors | where 'product' = "102" | eval result="app/".mvjoin(colors,",app/") | rex field=result mode=sed "s/,/*,/g" | eval result=result."*" | eval apps=split(result,",") | fields apps When i replace the string coming from |format into main query, i am getting the result. Can you please check what is wrong in this?   ... View more

what if i use "where" command to set the source. does it impact the performance? Example using #2 instead of #1 1. index=main sourcetype="access_combined" source="app1" 2. index=main sourcetype="access_combined" | where match(source,"app1")   ... View more

Thanks Giuseppe.  by the way i was using dashboard studio not the classic xml. I was thinking another way to do this by using token value as string with both values separated by some character (;) and use split method to get the value. I will check you method too. Thanks a lot ... View more

Actually, i want to set source as display_Name and use value in search for example -  index=main sourcetype="access_combined" source="App1" | search "Value1*" is there any simple way to achieve this?   ... View more

sorry - that is not working. Basically, I need to execute command like this index=main sourcetype="access_combined" "*search-val2*" where "search-val2" get evaluate from pipe(|) separated string   ... View more