Hi Everyone,
I am running a search:
| inputlookup MyLookup
| where Foo="$FooValueFromDropdown$"
| stats values(Price)
where, $FooValueFromDropdown$
replaces itself with a value coming from a drop-down above.
When drop-down is set to some value like Cadbury or Nestle, search works fine, but when the drop-down is set to All, search shows nothing.
I tried search
command, but it's not case-sensitive, which means if I have values like Cadbury(with capital C) and cadbury(with small c) and I select Cadbury with capital C, search will show results for both of them.
How can I use case-sensitivity of where
and wildcard(*) friendliness of search
together?
Please help.
Thank you 🙂
Here is a working example of what richgalloway is talking about:
index=_internal
| eval search_string="splunk*"
| eval search_string=replace(search_string, "\*", "%")
| where like(sourcetype, search_string)
Which can be simplified to:
... | where like(sourcetype, replace("splunk*", "\*", "%"))
Just replace "splunk*", with $FooValueFromDropdown$
Hi emiller42
Thanks for that example, it was useful. 🙂
Do you have any suggestions on the problem I mention as comment below richgalloway's answer?
Try like
.
... | where like(Foo,$FooValueFromDropdown$) | ...
The dropdown selection for All will have to be the SQL wildcard '%'.
Thanks richgalloway. 🙂
It's working but the $FooValueFromDropdown$
is a URI and contains "/" character. So when I am using double quotes around $FooValueFromDropdown$
like this
... | where like(Foo,"$FooValueFromDropdown$") | ...
it's showing no result for drop-down value - All
and when I am removing them, again I am not getting any results.
Any suggestions upon that?
How is 'All' defined in your search form?