Hello @yeahnah thanks, your xml works, but the results of the first input doesn't get authomatically populated in the following inputs. Asked differently, is it possible to use only one multiselect input to get this SPL: index=info (TERM(ERROR) OR TERM(WARN)) .... | more processing | search field=ERROR OR field=WARN So basically the result of multiselect input get formated once as "(TERM(ERROR) OR TERM(WARN))" and later as "field=ERROR OR field=WARN". My idea was to use one main multiselect, where I define one or several "terms", this result is used as a token in subsequent inputs (which should be hidden if possible), get formated using appropriate prefix/suffix/delimeter and used in the search string as: index=info $term$ .... | more processing | search $log_level_search$
... View more