Just want to mention, as an update, this is now trivial with Splunk 6.1 by using the multiselect input type. <input type="multiselect" token="my_animals"> <label>Types of animals in my soup</label> <populatingSearch earliest="$earliest$" latest="$latest$" fieldForLabel="animal_name" fieldForValue="genus_species"> index=fauna | stats dc(genus_species) by animal_name | fields animal_name genus_species </populatingSearch> <default>monkeys,lions</default> <delimiter>OR</delimiter> <valuePrefix>(my_animal=</valuePrefix> <valueSuffix>)</valueSuffix> </input> Now you can use the token $my_animals$ in a search and it will expanded into (my_animal=lions) OR (my_animal=monkeys) OR (my_animal=tigers) OR (my_animal=bears) ... View more