Splunk Search

How to group selected blade Id's to Multiselect option?

x186855
New Member

I have a desired list of blades and I had filtered out only those blade id's and now while creating a multiselect list I only want those blades to be grouped without using asterisk in value. Below is my query, so for "ALL" option I want only the blades filtered out in my search query. Currently, I'm using asterisk as a value but it is giving all the blades, please help me out so I can group only the desired blades against field name "ALL".

    <label>SIP Blades</label>
    <choice value="*">All</choice>
    <prefix>(</prefix>
    <suffix>)</suffix>
    <valuePrefix>Source="</valuePrefix>
    <valueSuffix>"</valueSuffix>
    <delimiter> OR </delimiter>
    <fieldForLabel>Source</fieldForLabel>
    <fieldForValue>Source</fieldForValue>
    <search>
      <query>index=eniq source="dbmon-tail://Eniq/DC_E_IMS_CSCF_PLTFMEAS_RAW" ( Source=* NOT (io1 OR io2 OR _SYSTEM OR Proc_m0_s1 OR Proc_m0_s3 OR Proc_m0_s5 OR Proc_m0_s7 OR Proc_m0_s13 OR Proc_m0_s15)) PlatformMeasures=DEFAULT  | stats count by Source
      <earliest>-24h@h</earliest>
      <latest>now</latest>
    </search>
    <default></default>
  </input>
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...