I am defining a dashboard panel that uses a token $s_user$ that may contain a comma-separated list of values (it is set from $row.field$ for a multivalue field). I want to find events where the user field matches one of the values in $s_user$ (as well as some other criteria).
For example, if $s_user$ is "user1,user2,user3", then I want a search that does the equivalent of:
client=$client$ AND (user=user1 OR user=user2 OR user=user3)
What is the best way to accomplish this?
I have tried the following, which works but seems clumsy (particularly since I have several tokens like s_user):
client=$client$ AND [search * | head 1 | eval user=split("$s_user$", ",") | fields user | format]
I have also tried this, which sort of works:
client=$client$ | eval users=split("$s_user$", ",") | where mvfind(users, user) >= 0
But that I suspect that is far slower, is also clumsy, and won't do the right thing if the user field contains regexp metacharacters.
Give this a try (should be faster than whatever you've tried so far)
client=$client$ AND [| gentimes start=-1 | eval user="$s_user$" | makemv delim="," user | mvexpand user | table user | format]
Give this a try (should be faster than whatever you've tried so far)
client=$client$ AND [| gentimes start=-1 | eval user="$s_user$" | makemv delim="," user | mvexpand user | table user | format]
Great.. Please accept the answer if there are no followup question around the same.
@somesoni2, can you please help here.
I have exactly similar case and I tried the answer you gave, its taking only first value and not all the values.
index=xxx_index| search Project="abc Online" AND [|gentimes start=-1|eval ref_incident_u_n_1_group = "abc Online MDT Support, abc Online Support" | makemv delim="," ref_incident_u_n_1_group|mvexpand ref_incident_u_n_1_group|table ref_incident_u_n_1_group|format ] |stats count by ref_incident_u_n_1_group work_queue
I will be passing token to ref_incident_u_n_1_group with , delimiter as in the query. Here for stats I get results for "abc Online MDT Support" but not for "abc Online Support". Is it because of spaces..? what could be the reason? please suggest
This is working now. Thanks much
That seems to work, and taught me about gentimes and helped me understand more about format.