Dashboards & Visualizations

Is there a way to conditionally match multivalue field contents to search token

tkwaller_2
Communicator

Hello

I have a Pivot report that contains a multivalue field called Tags. I have created a dropdown selector that uses mvindex to separate the values of the field. What I would like to do is be able to have the report display results based on the value of the dropwdown selection BUT the problem is that if I dont use the multivalues in the dropdown I cant get the results since they dont match.

Currently my pivot looks like this:

| pivot trackerv2 trackerv2 values(WorkflowStep01) AS "WorkflowStep01" values(WorkflowStep001) AS "WorkflowStep001" values(WorkflowStep002) AS "WorkflowStep002" values(WorkflowStep02) AS "WorkflowStep02" values(WorkflowStep003) AS "WorkflowStep003" values(WorkflowStep03) AS "WorkflowStep03" values(WorkflowStep004) AS "WorkflowStep004" values(WorkflowStep04) AS "WorkflowStep04" values(WorkflowStep005) AS "WorkflowStep005" values(WorkflowStep05) AS "WorkflowStep05" values(WorkflowStep006) AS "WorkflowStep006" values(WorkflowStep06) AS "WorkflowStep06" values(WorkflowStep07) AS "WorkflowStep07" values(WorkflowStep08) AS "WorkflowStep08" values(WorkflowStep09) AS "WorkflowStep09" values(SIGFINAL) AS "SIGFINAL" values(SECSUPPFINAL) AS "SECSUPPFINAL" SPLITROW ID AS ID SPLITROW Name AS Name SPLITROW Type AS Type SPLITROW LOB AS LOB SPLITROW TechDept AS TechDept SPLITROW OperatingCo AS OperatingCo SPLITROW AssessmentPurpose AS AssessmentPurpose SPLITROW AssignedToUser AS AssignedToUser SPLITROW Status AS Status SPLITROW CurrentWorkflowStep AS CurrentWorkflowStep SPLITROW NextResponsibleParty AS NextResponsibleParty SPLITROW DueDate-pendingaction AS "DueDate-pendingaction" SPLITROW DateEstCompleted AS DateEstCompleted SPLITROW ActualCompletionDate AS ActualCompletionDate SPLITROW Notes AS Notes SPLITROW LastUpdated AS LastUpdated SPLITROW Tags AS Tags SORT 100000 ID ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1 |search Tags=$tag_tok$

So a sample value of the Tags field would be like:
LEGAL, PILOT, Findings

The dropdown has single values of:
ALL
LEGAL
PILOT
Findings

but if I choose anything other than ALL I get nothing because the single values dont match the multivalues within the Tags field. How can I make the values match without having the dropdown be multivalued?

Something similar to(I know this isnt right):
|search Tags=if(like('Tags', "%$tag_tok$%"), 'Tags', "")

0 Karma
1 Solution

tkwaller_2
Communicator

I figured this out. What I did was have the search for the dropdown break apart the mv field. Then dedup and table the value. Then I had the prefix "* and a suffix of *" added to the value. Then in the search I added Tags=$tag_tok$ so the wildcarded value returns all results.

View solution in original post

0 Karma

tkwaller_2
Communicator

I figured this out. What I did was have the search for the dropdown break apart the mv field. Then dedup and table the value. Then I had the prefix "* and a suffix of *" added to the value. Then in the search I added Tags=$tag_tok$ so the wildcarded value returns all results.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...