Splunk Search

How to group multiselect drop-down values?

nravichandran
Communicator

I have a multi-select dropdown which is dynamically populated. I want to show only one option to the user to choose for a group of options and if the user selects then I should search for all the values in that group.
Example: The following results are returned from the dynamic search to populate the multi-select dropdown.
Value_one
Value_two
xyz_Unknown
abc_Unknown
fgh_Unknown
I want to present to the user the following:
Value_one
Value_two
Unknown

But when the user selects the Unknown I want to search for xyz_unknown, abc_unknown and fgh_Unknown.

Two questions:
1. How to Add "Unknown" to the multi-select dropdown (in addition to dynamically populated values and avoid xxx_Unknwon)
2. How to map the xxx_Unknown with Unknown? When user selectes Unknwon I should dynamically add to the value.

Thank you in advance.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Use this a your populating search for multiselect. Assuming the multi-select search returns field say host and in panel searches, it's used to match against field host only.

your base search giving result with field host | eval label=if(like(host ,"%_Unknown"),"Unknown",host ) | eval host ="host =".host  | stats values(host) as host by label delim="#" | nomv host | eval host =replace(host ,"#"," OR ") 

Use label as 'field for label' and host as 'field for value'
You may need to adjust your prefix-suffix things in multiselect based on how you're using this token in your search.

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Use this a your populating search for multiselect. Assuming the multi-select search returns field say host and in panel searches, it's used to match against field host only.

your base search giving result with field host | eval label=if(like(host ,"%_Unknown"),"Unknown",host ) | eval host ="host =".host  | stats values(host) as host by label delim="#" | nomv host | eval host =replace(host ,"#"," OR ") 

Use label as 'field for label' and host as 'field for value'
You may need to adjust your prefix-suffix things in multiselect based on how you're using this token in your search.

0 Karma

nravichandran
Communicator

Thank you!. You saved me lot of time.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...