Hello,
In one of my dashboards, I am using a filter field to search for one UserID. Can I edit my search or my filterfield, so it is possible to search for more than one userid as an input? e.g. like "userid1|userid2|userid3" as an input would resolve in something like "userid=userid1 OR userid=userid2 OR ..."
thanks in advance.
hype
You can use subsearches for the same. See the example below
index=_internal [| gentimes start=-1 | eval sourcetype="Your|Sourcetype|List|Goes|Here" | table sourcetype | makemv sourcetype delim="|" | mvexpand sourcetype ] | stats count by sourcetype
You can use subsearches for the same. See the example below
index=_internal [| gentimes start=-1 | eval sourcetype="Your|Sourcetype|List|Goes|Here" | table sourcetype | makemv sourcetype delim="|" | mvexpand sourcetype ] | stats count by sourcetype