Dashboards & Visualizations

How to assign the value to contain all events if using mvfind() in multiselect ?

Jouman
Path Finder

Hi all,

I deal with a multi-value fields and try to provide a multiselect dropdown for users.
Therefore, I use mvfind() in the setting for Token value(prefix) / Token value(Suffix).
Token value(Prefix) = isnotnull(mvfind( HWid, "
Token value(Suffix) = "))

It works well if I input one HW ID or many HW ID.
However, I get trouble in inputing "all".

I want to provide users all events by default but I am unable to find a way to do this by using mvfind().
It is similar as wildchar (all any values) to mvfind().
Is there any suggestion on how to provide all events on mvfind() ?

Thank you so much!

Jouman

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Set the value multiselect value for "all" to be .* so it effectively becomes

isnotnull(mvfind(HWid,".*"))

which will then find any value in HWid

View solution in original post

Jouman
Path Finder

The answer works perfectly! 

Thank you so much!

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Set the value multiselect value for "all" to be .* so it effectively becomes

isnotnull(mvfind(HWid,".*"))

which will then find any value in HWid

Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...