I have a multi-select dropdown which is dynamically populated. I want to show only one option to the user to choose for a group of options and if the user selects then I should search for all the values in that group.
Example: The following results are returned from the dynamic search to populate the multi-select dropdown.
Value_one
Value_two
xyz_Unknown
abc_Unknown
fgh_Unknown
I want to present to the user the following:
Value_one
Value_two
Unknown
But when the user selects the Unknown I want to search for xyz_unknown, abc_unknown and fgh_Unknown.
Two questions:
1. How to Add "Unknown" to the multi-select dropdown (in addition to dynamically populated values and avoid xxx_Unknwon)
2. How to map the xxx_Unknown with Unknown? When user selectes Unknwon I should dynamically add to the value.
Thank you in advance.
Use this a your populating search for multiselect. Assuming the multi-select search returns field say host
and in panel searches, it's used to match against field host
only.
your base search giving result with field host | eval label=if(like(host ,"%_Unknown"),"Unknown",host ) | eval host ="host =".host | stats values(host) as host by label delim="#" | nomv host | eval host =replace(host ,"#"," OR ")
Use label
as 'field for label' and host
as 'field for value'
You may need to adjust your prefix-suffix things in multiselect based on how you're using this token in your search.
Use this a your populating search for multiselect. Assuming the multi-select search returns field say host
and in panel searches, it's used to match against field host
only.
your base search giving result with field host | eval label=if(like(host ,"%_Unknown"),"Unknown",host ) | eval host ="host =".host | stats values(host) as host by label delim="#" | nomv host | eval host =replace(host ,"#"," OR ")
Use label
as 'field for label' and host
as 'field for value'
You may need to adjust your prefix-suffix things in multiselect based on how you're using this token in your search.
Thank you!. You saved me lot of time.