Dashboards & Visualizations

Is there a way to conditionally match multivalue field contents to search token

tkwaller_2
Communicator

Hello

I have a Pivot report that contains a multivalue field called Tags. I have created a dropdown selector that uses mvindex to separate the values of the field. What I would like to do is be able to have the report display results based on the value of the dropwdown selection BUT the problem is that if I dont use the multivalues in the dropdown I cant get the results since they dont match.

Currently my pivot looks like this:

| pivot trackerv2 trackerv2 values(WorkflowStep01) AS "WorkflowStep01" values(WorkflowStep001) AS "WorkflowStep001" values(WorkflowStep002) AS "WorkflowStep002" values(WorkflowStep02) AS "WorkflowStep02" values(WorkflowStep003) AS "WorkflowStep003" values(WorkflowStep03) AS "WorkflowStep03" values(WorkflowStep004) AS "WorkflowStep004" values(WorkflowStep04) AS "WorkflowStep04" values(WorkflowStep005) AS "WorkflowStep005" values(WorkflowStep05) AS "WorkflowStep05" values(WorkflowStep006) AS "WorkflowStep006" values(WorkflowStep06) AS "WorkflowStep06" values(WorkflowStep07) AS "WorkflowStep07" values(WorkflowStep08) AS "WorkflowStep08" values(WorkflowStep09) AS "WorkflowStep09" values(SIGFINAL) AS "SIGFINAL" values(SECSUPPFINAL) AS "SECSUPPFINAL" SPLITROW ID AS ID SPLITROW Name AS Name SPLITROW Type AS Type SPLITROW LOB AS LOB SPLITROW TechDept AS TechDept SPLITROW OperatingCo AS OperatingCo SPLITROW AssessmentPurpose AS AssessmentPurpose SPLITROW AssignedToUser AS AssignedToUser SPLITROW Status AS Status SPLITROW CurrentWorkflowStep AS CurrentWorkflowStep SPLITROW NextResponsibleParty AS NextResponsibleParty SPLITROW DueDate-pendingaction AS "DueDate-pendingaction" SPLITROW DateEstCompleted AS DateEstCompleted SPLITROW ActualCompletionDate AS ActualCompletionDate SPLITROW Notes AS Notes SPLITROW LastUpdated AS LastUpdated SPLITROW Tags AS Tags SORT 100000 ID ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1 |search Tags=$tag_tok$

So a sample value of the Tags field would be like:
LEGAL, PILOT, Findings

The dropdown has single values of:
ALL
LEGAL
PILOT
Findings

but if I choose anything other than ALL I get nothing because the single values dont match the multivalues within the Tags field. How can I make the values match without having the dropdown be multivalued?

Something similar to(I know this isnt right):
|search Tags=if(like('Tags', "%$tag_tok$%"), 'Tags', "")

0 Karma
1 Solution

tkwaller_2
Communicator

I figured this out. What I did was have the search for the dropdown break apart the mv field. Then dedup and table the value. Then I had the prefix "* and a suffix of *" added to the value. Then in the search I added Tags=$tag_tok$ so the wildcarded value returns all results.

View solution in original post

0 Karma

tkwaller_2
Communicator

I figured this out. What I did was have the search for the dropdown break apart the mv field. Then dedup and table the value. Then I had the prefix "* and a suffix of *" added to the value. Then in the search I added Tags=$tag_tok$ so the wildcarded value returns all results.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...