With Sideview Utils you can do this with ValueSetter and ArrayValueSetter.
the Pulldown or SearchSelectLister will have values like /DIR1/,/DIR2/,/DIR3/*
The ValueSetter will basically split the values on that sensible delimiter, so it will output an array-valued key containing the three values. (If comma is not a safe delimiter you just use a different char and specify a different delim param in ValueSetter.
Then ArrayValueSetter will turn the array valued key into the corresponding search expression, in this case uri="/DIR " OR uri="/DIR2/" OR uri="/DIR3/*"`
You could in theory use ConvertToIntention from there and turn this into a "stringreplace intention", but that's kind of crazy. If you're already using Sideview Utils you should just use the Sideview Search module instead of Splunk's HiddenSearch, and forget about intentions. With the search module you can just plug the key right in.
Also you could in theory keep using SearchSelectLister but the Sideview Pulldown module is far easier and more straightforward to deal with, so I would switch over there as well.
The next steps are really for you to check out Sideview Utils, read the first few pages in the docs, then read the docs and embedded living examples for Pulldown, Search, ValueSetter and ArrayValueSetter, and then you'll be on a very happy road. However to also give you a peek at what the final result will be, it's something like this. Including the search that feeds the Pulldown at the top, and the search into which we plug the boolean expression at the bottom. I also turned your multivalue source field into a more conventional string-valued field where the multiple values are explicitly separated by commas. This just makes everything a little more predictable and you dont have to split on space characters.
<module name="Search">
<param name="search">
| inputlookup sourcenames.csv | stats values(source) as source by sourcename | eval source=mvjoin(source,",")
</param>
<module name="Pulldown">
<param name="name">uri</param>
<param name="label">URI</param>
<param name="valueField">source</param>
<module name="ValueSetter">
<param name="name">uriArray</param>
<param name="delim">,</param>
<param name="value">$uri$</param>
<module name="ArrayValueSetter">
<param name="name">uriSearch</param>
<param name="array">$uriArray.rawValue$</param>
<param name="template">uri="$value$"</param>
<param name="separator">+OR+</param>
<param name="outerTemplate">( $value$ )</param>
<module name="Search">
<param name="search">
foo bar baz $uriSearch$ | timechart count
</param>
Sideview Utils has a lot of modules and the bread-and-butter ones are simple straightforward modules like Search, TextField, Pulldown, Table, HTML etc.. Whereas ValueSetter and ArrayValueSetter are more advanced modules that you only need or use rarely. Once you get the hang of all of it you'll be using them in place of the corresponding Splunk modules and you'll find that your views are made up of mostly Sideview modules...
remember that while the latest Sideview Utils is free for internal use, you can only get it from the Sideview website:
http://sideviewapps.com/apps/sideview-utils
... View more
