Hi
In a MultiSelect is there any way to us a wild character?
My Data
XYC_123
EOD_1234
EOD_23232
EOD_343434
aassss_34343
So, i would like to pick all the EOD so (Star)EOD(Star).
I can put this in manually, however, I want to do it dynamically from the search box.
I want to put in (Star)ANYTHING(Star)
@jeffland Thanks for the solution. That's exactly what I was looking for.
https://docs.splunk.com/Documentation/Splunk/8.0.0/Viz/PanelreferenceforSimplifiedXML#input_.28form....
try this run anywhere example:
<form>
<label>Checkbox</label>
<fieldset submitButton="false">
<input type="checkbox" token="source" searchWhenChanged="true">
<label>Source</label>
<default></default>
<fieldForLabel>source</fieldForLabel>
<fieldForValue>source</fieldForValue>
<search>
<query>index=_* | eval source=substr('source',1,5) | stats count by source</query>
<earliest>0</earliest>
<latest></latest>
</search>
<choice value="">ALL</choice>
<initialValue></initialValue>
<delimiter> OR </delimiter>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>source like "%</valuePrefix>
<valueSuffix>%"</valueSuffix>
</input>
</fieldset>
<row>
<panel>
<table>
<title>$source$</title>
<search>
<query>index=_* | where $source$ | stats count</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>
Reference: https://answers.splunk.com/answers/615201/why-is-the-checkbox-input-filter-source-in-my-dash.html
The easy solution to this is the option "allowCustomValues" on a multiselect. With this, you can input custom values that can include a wildcard.
<input type="multiselect" token="multi_tok">
<label>multi with custom values</label>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search>
<query>| tstats count where index=_internal by sourcetype</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<allowCustomValues>true</allowCustomValues>
</input>