Dashboards & Visualizations

Is there a way to conditionally match multivalue field contents to search token

tkwaller_2
Communicator

Hello

I have a Pivot report that contains a multivalue field called Tags. I have created a dropdown selector that uses mvindex to separate the values of the field. What I would like to do is be able to have the report display results based on the value of the dropwdown selection BUT the problem is that if I dont use the multivalues in the dropdown I cant get the results since they dont match.

Currently my pivot looks like this:

| pivot trackerv2 trackerv2 values(WorkflowStep01) AS "WorkflowStep01" values(WorkflowStep001) AS "WorkflowStep001" values(WorkflowStep002) AS "WorkflowStep002" values(WorkflowStep02) AS "WorkflowStep02" values(WorkflowStep003) AS "WorkflowStep003" values(WorkflowStep03) AS "WorkflowStep03" values(WorkflowStep004) AS "WorkflowStep004" values(WorkflowStep04) AS "WorkflowStep04" values(WorkflowStep005) AS "WorkflowStep005" values(WorkflowStep05) AS "WorkflowStep05" values(WorkflowStep006) AS "WorkflowStep006" values(WorkflowStep06) AS "WorkflowStep06" values(WorkflowStep07) AS "WorkflowStep07" values(WorkflowStep08) AS "WorkflowStep08" values(WorkflowStep09) AS "WorkflowStep09" values(SIGFINAL) AS "SIGFINAL" values(SECSUPPFINAL) AS "SECSUPPFINAL" SPLITROW ID AS ID SPLITROW Name AS Name SPLITROW Type AS Type SPLITROW LOB AS LOB SPLITROW TechDept AS TechDept SPLITROW OperatingCo AS OperatingCo SPLITROW AssessmentPurpose AS AssessmentPurpose SPLITROW AssignedToUser AS AssignedToUser SPLITROW Status AS Status SPLITROW CurrentWorkflowStep AS CurrentWorkflowStep SPLITROW NextResponsibleParty AS NextResponsibleParty SPLITROW DueDate-pendingaction AS "DueDate-pendingaction" SPLITROW DateEstCompleted AS DateEstCompleted SPLITROW ActualCompletionDate AS ActualCompletionDate SPLITROW Notes AS Notes SPLITROW LastUpdated AS LastUpdated SPLITROW Tags AS Tags SORT 100000 ID ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1 |search Tags=$tag_tok$

So a sample value of the Tags field would be like:
LEGAL, PILOT, Findings

The dropdown has single values of:
ALL
LEGAL
PILOT
Findings

but if I choose anything other than ALL I get nothing because the single values dont match the multivalues within the Tags field. How can I make the values match without having the dropdown be multivalued?

Something similar to(I know this isnt right):
|search Tags=if(like('Tags', "%$tag_tok$%"), 'Tags', "")

0 Karma
1 Solution

tkwaller_2
Communicator

I figured this out. What I did was have the search for the dropdown break apart the mv field. Then dedup and table the value. Then I had the prefix "* and a suffix of *" added to the value. Then in the search I added Tags=$tag_tok$ so the wildcarded value returns all results.

View solution in original post

0 Karma

tkwaller_2
Communicator

I figured this out. What I did was have the search for the dropdown break apart the mv field. Then dedup and table the value. Then I had the prefix "* and a suffix of *" added to the value. Then in the search I added Tags=$tag_tok$ so the wildcarded value returns all results.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...